chore(onboard): wire quickstart to the content profile

[LukasWodka]

Wires tracebloc/quickstart to the content profile (profiles/content.yml in tracebloc/org-config).

• .github/workflows/add-to-kanban.yml
• .github/workflows/advance-deploy-env.yml
• .github/workflows/bugbot-gate.yml
• .github/workflows/code-quality.yml
• .github/workflows/customer-priority-bump.yml
• .github/workflows/fr-gate.yml
• .github/workflows/fr-pass-comment.yml
• .github/workflows/kanban-closure-router.yml
• .github/workflows/set-pr-status.yml
• .github/workflows/stale-backlog.yml

Opened by scripts/onboard_repo.py. Callers are this repo's own callers with the
uses: host re-pointed; the kanban copy is the canonical bytes the conformance audit
compares; CLAUDE.md and BUGBOT.md are skeletons to fill in (never overwritten on a
re-run). The matching repo-inventory.yml entry is derived from the same profile.

---

Note

Low Risk
Comment and message scrubbing plus regenerated workflow copies; no change to job logic, secrets, or token scopes beyond onboarding artifacts.

Overview
Onboards quickstart to the org content profile: it lands the standard generated workflow bundle (kanban, deploy advance, quality gates, FR gate, etc.) plus skeleton CLAUDE.md and .cursor/BUGBOT.md, matching what the conformance audit expects for a public-facing repo.

The substantive change in those files is public-surface scrubbing, not new automation behavior. Generated workflow headers now document the PUBLIC SURFACE rule, and comments that used to cite private tickets, RFCs, or repo names are replaced with (internal ref) (via scripts/public_surface.py in org-config). A few user-visible strings are generalized the same way (e.g. FR gate’s manual-promotion error no longer names a specific private repo; some auto-created label descriptions drop internal ticket ids).

Workflow steps, triggers, and permissions are unchanged aside from refreshed self-contained render metadata (blob hashes in headers for some workflows).

^{Reviewed by Cursor Bugbot for commit ce52c45. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit af11e5d. Configure here.}

[LukasWodka]

bugbot run

[saqlainsyed007]

Automated review (code-review-desk, recall-biased pass). 3 findings, most severe first.

[saqlainsyed007]

This is a mechanical onboarding PR (scripts/onboard_repo.py) wiring quickstart to the org's content profile: regenerated self-contained workflow copies with the new PUBLIC SURFACE header, backend#NNNN/RFC-id scrubbing to (internal ref), and skeleton CLAUDE.md/.cursor/BUGBOT.md updates. No job logic, permissions, or secrets change — confirmed by reading the full diff.

I ran /code-review --comment, which posted 3 inline findings. I verified each directly against the upstream source in tracebloc/org-config (private repo, confirmed via gh repo view) before deciding whether any block merge:

1. code-quality.yml:731 and kanban-closure-router.yml:514 — flagged as private ticket refs silently stripped from non-comment strings (print(...)/CLOSE_NOTE), supposedly violating the file's own documented rule that a reference outside a comment must refuse the render rather than be edited. I pulled the actual org-config develop source for both files (blob shas match this PR's cited hashes exactly) and found the ticket refs are already absent upstream — this PR is a faithful byte-for-byte copy of an upstream change, not a scrub-script defect. Both findings are false positives; replied inline with the verification.
2. tracebloc/org-config named unredacted throughout (88 occurrences) — factually true, but this string is unchanged by this PR (it appears in unmodified context lines; only the blob hash and the new PUBLIC SURFACE block are additions), and every previously-onboarded public repo carries the same unredacted mentions. This is existing, org-wide public_surface.py behavior — repo names apparently aren't in its scrub scope, only ticket/RFC/tenant refs are — not a regression this PR introduces. Worth raising separately with whoever owns public_surface.py, but not a reason to hold this specific PR.

Gate is clean: all CI green (bugbot / review, d9-rules, gate/gate, quality/*, set-status/* all pass; Cursor Bugbot shows skipping, which is expected — it's superseded by the bugbot-gate wrapper per this same PR's own workflow), no merge conflicts, no open Bugbot review threads. Approving.

[LukasWodka]

FR pass on staging: reviewed the diff and behavior against the merged description, no functional concerns found. Passing.

/fr-pass