Why "anonymized" test data still fails compliance review: the PCI, SOC 2 and GDPR rules that apply to pre-production, and two real breaches that prove it.