Remove private infrastructure identifiers from public source

[usr-bin-roygbiv]

Summary

• remove private machine and Tailnet identifiers from public CI configuration, chart defaults, operator tests, and proof schemas
• replace topology-specific node defaults with explicit runtime inputs and neutral fixture identities
• add a repository-wide privacy contract that rejects semantic Tailnet service names, machine-style Kubernetes node names, and non-anonymous owner references

Validation

• the six commits preserve test-first ordering: privacy and node-identity contracts precede the implementation, and matcher boundary coverage precedes the precision fixes
• GitHub Actions runs 30811472988 and 30812368782 exposed an overly broad repository-owner matcher and then its literal test sentinels; the follow-ups distinguish local paths from hosted repositories and construct synthetic remotes at runtime so the repository-wide scan does not exempt test source
• deployable-repository gates were not run from an operator host; GitHub Actions will validate the updated branch and pull request