Workflow: anonymized branches for safe development data

# Workflow: anonymized dev branches

## Goal
Realistic development data with no real personal data in it.

## Steps
1. Define anonymization rules for personal data columns (contact details, names, addresses): masking, hashing, or fake-data substitution that preserves format and uniqueness constraints.
2. Create dev branches from production with anonymization applied.
3. Verify the anonymization: sample the dev branch and confirm no real personal data survived, especially in free-text columns and JSON blobs where column rules miss.
4. Hand developers the anonymized branch connection string; production strings never leave the production context.

## Ordering constraints
- Rules first, branch second; you cannot un-leak PII from a branch already shared.
- Re-verify after every schema change that adds a column; new columns default to unmasked.

## Traps
- Format-preserving fakes that keep uniqueness: using the same placeholder address for every row breaks unique constraints; the anonymization must handle that.
- JSONB columns with nested PII are the most common miss; cover them explicitly.
- Anonymized branches still cost storage and compute; expire them like any dev branch.

## Verify
Automated check on branch creation samples PII columns and fails the pipeline if real-looking data is found.