[privacy] remove Community Chatwoot Hub egress

Remove Community Chatwoot Hub URL/push relay/sync/registration/event/changelog
egress. changelog.js becomes a local empty-feed adapter (no axios/fetch/network)
exporting the default ChangelogApi; links.js drops the Hub changelog URL.
lib/chatwoot_hub.rb removes base_url/push_notification_url/billing_base_url/
instance_config/send_push/send_push_with_response; billing_url reads only an
explicit CHATWOOT_BILLING_URL env, HTTPS-only with host and no userinfo, and
never falls back to a Hub URL. Enterprise proprietary base_url override is
preserved (spec uses singleton_class.instance_methods(false) for edition-safety).
privacy_audit uses a narrow per-file/per-rule Enterprise exception (hub-url
only) and privacy_audit_test.sh proves forbidden Enterprise runtime lines are
still detected; deployment privacy guard unchanged. Approved by independent
five-key review deleg_49d6ee2e (passed=true, blocking arrays empty).

script/privacy_audit

@@ -33,7 +33,27 @@ VISIBLE_BRANDING = re.compile(r"\bChatwoot\b")
 VISIBLE_ROOTS = ("app/views", "app/javascript", "config/locales", "public")
 BUILT_ROOTS = ("public/assets", "public/packs", "public/vite")
 SKIP_PARTS = {".git", "node_modules", ".pnpm-store", "tmp", "log", "coverage", "storage"}
-DEFAULT_ALLOWED_PATHS = {"LICENSE", "script/privacy_audit", "script/privacy_audit_test.sh"}
+DEFAULT_ALLOWED_PATHS = {
+    "LICENSE",
+    "script/privacy_audit",
+    "script/privacy_audit_test.sh",
+    "deployment/spec/setup_20.04_privacy_test.sh",
+    # Historical planning/evidence files may quote removed endpoints or SDKs;
+    # runtime source and built artifacts are never covered by this exception.
+    ".hermes/plans/2026-08-15_092534-chatwoot-private-rebrand.md",
+    ".hermes/plans/chatwoot-private/06-remove-amplitude.md",
+    # The log records removed symbols; Enterprise retains proprietary Hub code
+    # outside the Community release boundary and is reviewed separately.
+    "engineering-log.md",
+    "spec/enterprise/lib/chatwoot_hub_spec.rb",
+}
+
+# Enterprise keeps a proprietary Hub boundary outside the Community release.
+# Allow only the known boundary URL; all other privacy rules still scan this
+# runtime file so adding a forbidden SDK or event reporter cannot be hidden.
+DEFAULT_ALLOWED_RULES = {
+    "enterprise/lib/enterprise/chatwoot_hub.rb": {"hub-url"},
+}
 
 
 def parse_args() -> argparse.Namespace:
@@ -176,12 +196,13 @@ def main() -> int:
         text = read_text(path)
         if text is None:
             continue
-        allowed = relative in allowlist
+        allowed_path = relative in allowlist
+        allowed_rules = DEFAULT_ALLOWED_RULES.get(relative, set())
 
         for line_number, line in enumerate(text.splitlines(), start=1):
             for category, pattern in RULES:
                 if pattern.search(line):
-                    if allowed:
+                    if allowed_path or category in allowed_rules:
                         continue
                     prefix = "REPORT" if args.report_only else "FAIL"
                     print(f"{prefix} {relative}:{line_number}:{category}")