docs: prepare pii history rewrite runbook

[Euda1mon1a]

Summary

• add a non-destructive scripts/pii_history_rewrite_preflight.sh readiness check for the human-run PII history purge
• tighten docs/operations/PII_HISTORY_REWRITE_RUNBOOK.md around backup bundles, fresh-clone execution, rollback, and collaborator freeze/re-clone steps
• refresh docs/security/PII_AUDIT_LOG.md, TODO.md, and CHANGELOG.md so the live git filter-repo path points at the current runbook instead of the old archived plan

Validation

• bash -n scripts/pii_history_rewrite_preflight.sh scripts/cleanup_pii_history.sh
• ./scripts/pii_history_rewrite_preflight.sh (expected to exit 1 on this machine until git-filter-repo is installed; the repo itself is clean)

Notes

• This PR does not rewrite history or force-push anything. It only prepares the human-only maintenance event.
• Current machine prerequisite still missing: git-filter-repo is not installed on PATH. The preflight now prints brew install git-filter-repo / pipx install git-filter-repo guidance directly.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.