fix: remove molt references + sync script; add molt to PII blocklist

.github/workflows/pii-check.yml

@@ -24,9 +24,9 @@ jobs:
           # Patterns considered PII for this public repo.
           # Exclude the workflow itself and the sync script — both legitimately
           # mention the patterns (the workflow defines them; the sync script scrubs them).
-          PATTERN='/Users/|clients/self|rdemeritt'
+          PATTERN='/Users/|clients/self|rdemeritt|molt-and-deploy'
           INCLUDES=(--include='*.md' --include='*.sh' --include='*.json' --include='*.yaml' --include='*.yml')
-          EXCLUDES=(--exclude-dir='.git' --exclude-dir='node_modules' --exclude='pii-check.yml' --exclude='sync-to-public.sh')
+          EXCLUDES=(--exclude-dir='.git' --exclude-dir='node_modules' --exclude='pii-check.yml')
 
           echo "Scanning for pattern: $PATTERN"
           if hits=$(grep -rnE "$PATTERN" . "${INCLUDES[@]}" "${EXCLUDES[@]}"); then

README.md

@@ -161,7 +161,6 @@ freelance-developer-harness/
 ├── docs/                  # SOPs, workflows, onboarding
 ├── scripts/
 │   ├── setup.sh                 # Interactive first-time configuration
-│   └── sync-to-public.sh        # Sync generic improvements from a private fork to this repo
 ├── CLAUDE.md              # Harness operating model — loaded automatically by Claude Code
 ├── AGENTS.md              # Team roster, authorities, gates, governance matrix
 └── README.md
@@ -267,38 +266,6 @@ This is the only source of sprint truth. Specs, ADRs, and PM summaries continue
 
 ---
 
-## Syncing with `molt-and-deploy-harness`
-
-This public repo is downstream of an internal private harness called `molt-and-deploy-harness`. Generic improvements (new agents, commands, patterns) are pushed downstream with `scripts/sync-to-public.sh`, which scrubs PII and refuses to copy client-specific material.
-
-```bash
-# Dry run first — shows what would change, makes no edits
-scripts/sync-to-public.sh \
-  --source /path/to/molt-and-deploy-harness \
-  --target /path/to/freelance-developer-harness \
-  --dry-run
-
-# Real sync — creates branch sync/from-molt-<date> in TARGET and stages a PR
-scripts/sync-to-public.sh \
-  --source /path/to/molt-and-deploy-harness \
-  --target /path/to/freelance-developer-harness
-```
-
-Hard rules enforced by the script:
-
-- `SOURCE` is never modified
-- `TARGET` writes happen on a fresh branch (`sync/from-molt-<date>`)
-- Blocklist beats allowlist — client-specific paths (`clients/<real-client>/`, session files, secrets) are never copied even if matched by an allowlist rule
-- A `sed` scrubber replaces hardcoded paths with `$SOURCE_ROOT_BASE/` placeholders
-- The `Active Clients` table in `CLAUDE.md` is reset to the single template row
-- A PII guard runs in CI on every PR — if PII slips through, the PR fails
-
-Exit codes: `0` success · `1` usage error · `2` PII detected post-scrub · `3` source/target invalid.
-
-You can run this script independently; you do not need access to the private repo to use the public harness.
-
----
-
 ## Contributing
 
 Issues, ideas, and pull requests are welcome.