chore: de-link parent organization from public tree and add an identity gate

[verlyn13]

Stacked on #66 — merge #66 first, see Ordering below.

Why

system-config is public and now has outside readers. The identity registry gives the parent organization linkPolicy: no-link / publicAlias: "parent organization", and docs/git-identity.md forbids committing "registry.json or any value from it". registry.json itself is clean — never tracked, never added in any commit, gitignored twice. The values rule was the one being violated, and nothing enforced it.

1. OpenBao host identity → machine data

home/private_dot_ssh/private_conf.d/tng-openbao.conf.tmpl was the highest-value single artifact in the repo. Fourteen lines that published, together: the parent org's real name, a publicly routable IPv4 (verified non-RFC1918), User root, and the operator key filename. A no-link entity's secrets manager, by reachable address, with root login, in a repo carrying the operator's real identity on every commit.

Host identity now comes from [data.ssh.parent_org_openbao] in ~/.config/chezmoi/chezmoi.toml. Guarded with hasKey rather than a bare lookup, because chezmoi runs missingkey=error and a bare key breaks rendering on an unconfigured machine.

⚠️ Operator action required before the next chezmoi apply. Add the [data.ssh.parent_org_openbao] table, or the live ~/.ssh/conf.d/tng-openbao.conf loses its Host entry and the alias stops resolving. Example values in the template are RFC 5737 documentation addresses.

2. Name sweep — 142 → 42 occurrences

100 incidental occurrences removed across 28 files. Biggest single win: docs/google-admin-tooling.md 15 → 0, which was publishing a Google Workspace super-admin mailbox beside the exact gcloud auth login invocation that uses it.

Deliberately not changed, because changing the prose while the identifier stays would make the docs wrong:

• SSH host alias github.com-nash-group, key filename id_ed25519_nash-group, 1P item path ssh/workstation/nash-group/github
• iterm2/profiles/*.json and the four docs describing them — the filenames and "Bound Hosts" globs are matched at runtime
• policies/host-capability-substrate/tiers.yaml — byte-pinned by a sibling repo

This reduces exposure; it does not de-link the organization. Two tracked filenames still carry the name (10-nash-guardian-l0.json, 11-nash-repos.json). Completing that means renaming live artifacts and a vault item — a separate operator-gated change.

3. The enforcement gap

identity_no_registry_values_committed greps git ls-files for a file named registry.json and runs check-ignore. Zero content inspection. It reported green throughout. ng-doctor is also never executed by CI — validate-repo.sh only shellchecks its template.

Two content scans added to the gate CI actually runs:

• Parent-org name. Does not match bare nash-group, which only occurs inside the structural identifiers above.
• Emails outside an allowlist. The allowlist is what makes this runnable rather than permanently red — it passes vendor, RFC-reserved and operator-owned domains, and fails personal and third-party addresses.

Email failure output is masked to localpart-initial. CI logs on a public repo are public; echoing a matched address would publish, durably and indexably, the exact value the step exists to keep out. The org-name scan prints unmasked, which is correct — that name is already public via the structural files.

Exclusions are structural, not cosmetic: iterm2/**, docs/iterm2-*.md, zz-iterm2.zsh, the byte-pinned tiers.yaml, tests/policies/** (negative fixtures whose values are the test input), and home/.chezmoidata.yaml (allowed_signers principals must byte-match the signing identity or verification stops).

Ordering

This gate fails on main until #66 lands. That is intended, not a regression. Verified: the six files the email scan flags are exactly the six #66 fixes — so the merged state passes.

Validation

• shellcheck clean at the pinned 0.11.0
• Gate fires correctly on the current tree and its output is masked
• No structural file appears in the sweep diff (asserted explicitly in the commit)
• chezmoi execute-template renders the OpenBao template safely with the key absent

Not in scope

History. The name reaches the root commit, so a full rewrite is 335/335 commits and destroys 250 verifiable signatures, and cleans none of the GitHub-side residue. Recommendation is accept-and-document; that decision is yours.

[verlyn13]

Superseded by the accepted successor series: #76 established value-blind public-source privacy enforcement, #77 removed whole-file historical privacy exemptions while preserving public-safe provenance, and #78 moved the remaining machine-specific SSH identity behind validated private machine data with fail-closed destination semantics. The successor changes were independently reviewed, validated, and merged; this older combined branch is no longer a merge candidate.