feat(privacy-llm): foundation — PII redactor + approved-LLM contracts

[potiuk]

Summary

PR-1 of three. Lays the framework + docs for handling private mail content with privacy-aware LLM routing. Per-skill wiring is deferred to PR-2 (security@-touching skills get the PII-redactor hooks) and PR-3 (private@-touching skills get the approved-LLM gate).

Two distinct mechanisms, deliberately separated:

1. PII redaction — reporter name, email, phone, IP, personal handle replaced with hash-prefixed identifiers (R-a3f9d2, …) before any LLM-bound step. Mapping kept local at ~/.config/apache-steward/pii-mapping.json. Always-on for <security-list> content.
2. Approved-LLM gate — <private-list> content can only reach LLMs in the approved registry. Default-approved: Claude Code itself, *.apache.org-hosted endpoints, local-only inference (Ollama / vLLM on 127.0.0.1). Everything else (AWS Bedrock, direct Anthropic, …) is opt-in via <project-config>/privacy-llm.md.

What lands:

• tools/privacy-llm/{tool,pii,models}.md — the contracts.
• tools/privacy-llm/redactor/ — stdlib-only Python helper, three CLIs (pii-redact, pii-reveal, pii-list), 48 passing unit tests.
• docs/setup/privacy-llm.md — six setup-variant recipes, marked provisional pending ASF Legal.
• projects/_template/privacy-llm.md — adopter starting point.
• AGENTS.md — new "Privacy-LLM" section codifying the three rules.
• .pre-commit-config.yaml — new redactor-{ruff-check,ruff-format,mypy,pytest} hooks mirroring the oauth-draft pattern.

Status: the default-approved registry reflects the framework maintainer's working position; ASF Legal Affairs has not yet ratified an authoritative list. When such a list lands, the registry will be updated to point at it as source-of-truth.

Test plan

• pytest — 48 passed

• ruff check src tests — clean

• ruff format --check src tests — clean

• mypy — no issues found in 10 source files

• Visual review of AGENTS.md diff — new "Privacy-LLM" section reads as a sibling to "Confidentiality of the tracker repository".

• Walk through one of the variant recipes in docs/setup/privacy-llm.md end-to-end.

• Sanity-check the redactor end-to-end:

  echo "Hi I am Jane Smith and my email is jane@example.com" | \
    uv run --project tools/privacy-llm/redactor pii-redact \
    --field reporter:"Jane Smith" --field email:"jane@example.com"