fix: scrub PII from apple-signing env example + docs that quoted it

docs/plan.md

@@ -925,7 +925,7 @@ checkable change — no redesigns.*
       quickstart, prerequisites (Ollama), where data lives, license note.
       Highest-ROI 20-minute task in the repo.
 - [x] **Scrub PII from `scripts/apple-signing.env.example`.** It contains a
-      real Apple ID email (`james.twose2711@gmail.com`) in a tracked file.
+      real Apple ID email in a tracked file.
       Replace with `you@example.com`.
 - [x] **Delete dead scaffold: `src/components/Greet.tsx` + the `greet`
       Tauri command in `src-tauri/src/lib.rs`.** Leftover from

docs/repo-review.md

@@ -37,8 +37,9 @@ the README's data-locations table.
 ### P0-2. PII still in `scripts/apple-signing.env.example`
 
 `plan.md` §17.1 marks "Scrub PII" as done. It isn't: the file still contains
-the real Apple ID (`james.twose2711@gmail.com`) and the real Team ID
-(`4759TW4SDC`). 5-minute fix, do it before the next push.
+the real Apple ID email and Team ID (and both docs quote them). 5-minute fix,
+do it before the next push. Note: the values are already in git history from
+earlier commits — scrubbing stops future copies, not the past.
 
 ### P1-1. "Streaming" is a single fake token — the biggest UX lever left