feat: expand PII scrubber regression benchmarks

[Oluwatobi843]

Summary

Resolves #767 — adds false-positive/false-negative regression fixtures, a reproducible benchmark script, scrubber bug fixes, and CI integration.

---

Problem

The original PII scrubber had two known bugs:

• Phone regex too greedy: matched years (2024), dates (2024-07-28), prices ($4500), port numbers (8080)
• ID regex too broad: any 4+ digit standalone number was redacted, including years and version numbers

The original fixture set (4 cases) had no false-positive or false-negative coverage, so these bugs were invisible.

---

Changes

scrubber.py

• Phone regex now uses a broad capture + digit-count filter (≥ 7 digits required)
• ISO 8601 dates (YYYY-MM-DD) are stashed before phone matching and restored after
• Currency-prefixed numbers ($£€) and slash-separated numbers (date paths) are excluded
• Numeric ID threshold raised from 4+ digits → 8+ digits
• Email pass runs first so digit groups inside email tokens don't trigger phone/ID passes

tests/fixtures/pii_inputs.json + expected_outputs.json

Expanded from 4 to 22 test cases across four categories:

Category	Count	Purpose
Basic	4	Core PII types (email, phone, ID, safe text)
False-positive	7	Safe data that must NOT be redacted (years, dates, versions, prices, ports)
False-negative	6	PII variants that MUST be caught (subdomain email, local phone, national ID, mixed PII)
Edge	5	Tricky in-context cases

tests/benchmark_pii.py (new)

Reproducible benchmark script with:

• Accuracy %, per-category pass/fail breakdown
• Throughput measurement (calls/sec, avg latency ms)
• --output FILE for JSON report (CI artifact upload)
• --min-accuracy PCT flag — exits 1 if below threshold

.github/workflows/ci-python-tests.yml

• Extended paths triggers to include scrubber.py and tests/**
• New pii-scrubber job: runs pytest + benchmark with --min-accuracy 95
• Benchmark JSON report uploaded as a 30-day retained CI artifact

---

Test results

22 cases — 100% accuracy
  ✓ basic           4/4
  ✓ false_positive  7/7
  ✓ false_negative  6/6
  ✓ edge            5/5
Throughput: ~51,000 calls/sec

---

Acceptance criteria

• Fixture set includes hard false-positive and false-negative examples
• Benchmark output is reproducible in CI or local runs
• Results are easy to compare between revisions (JSON artifact + stdout table)

[drips-wave]

@Oluwatobi843 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Cedarich]

Fix failed CI