chore(template): clean-slate template snapshot from bb4a0c7

Curated, product-agnostic snapshot of the post-story-04 tree: demo
content deleted, auth-only reference feature, web-next shell, all gates
green. Product-specific docs, ADRs 027-029, PRDs/epics/archive, editor
library traces, and product naming are curated out; generic template
repairs (coverage provider devDeps, root test:coverage script, live
lint fixes, root-only release-please) are kept. See TEMPLATE.md for
provenance, curation list, and usage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

.github/workflows/sentry-pii-guard.yml

@@ -0,0 +1,28 @@
+# R31 — block sendDefaultPii: true from ever landing.
+#
+# This is a defense-in-depth gate: the privacy posture is also enforced by
+# the centralized init helpers in core-shared/instrumentation/sentry/, but
+# this grep makes any drift impossible to merge.
+
+name: Sentry PII guard (R31)
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  pii-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Verify sendDefaultPii is never true
+        run: |
+          if grep -RIn --include='*.ts' --include='*.tsx' --include='*.mjs' --include='*.cjs' --include='*.js' \
+              --exclude-dir=node_modules --exclude-dir=.next --exclude-dir=dist --exclude-dir=.turbo \
+              -E 'sendDefaultPii\s*:\s*true' \
+              packages/ apps/; then
+            echo "::error::R31 violation — sendDefaultPii: true is forbidden anywhere in the repo."
+            exit 1
+          fi
+          echo "OK — no sendDefaultPii: true detected."