bug: security:sast:masking fails on main — 6 silent-success-masking findings (unrelated to #532)

## Summary

`mise run security:sast:masking` **fails on `main`** (`ba3f936`) with 6 blocking `silent-success-masking` (AI004) findings. This is a pre-existing latent failure, discovered while implementing #532 (not caused by it). It means the full `mise run security` suite is still red on `main` even after #532 merges.

## Findings (file:line — rule)

```
agent/src/config.py:392 py-silent-success-masking
agent/src/config.py:406 py-silent-success-masking
agent/src/config.py:428 py-silent-success-masking
cdk/src/handlers/shared/jira-feedback.ts:152 ts-silent-success-masking
cli/src/commands/jira.ts:299 ts-silent-success-masking
cli/src/commands/linear.ts:1629 ts-silent-success-masking
```

## Fix (per rule guidance)

For each: either re-raise / throw a typed error / return a failure-encoding shape so the caller can distinguish failure from empty — **or**, if the fallback is intentional degraded-mode behavior, keep it and add a justified inline `nosemgrep: -- ` on the return line. Each site needs a judgment call by the owning code's author, not a blanket suppression.

## Acceptance criteria

- `mise run security:sast:masking` passes on `main`.
- Any retained fallback carries a justified `nosemgrep` explaining why silent success is safe there.

## Context

Discovered during #532 implementation via the pre-push security hook. Note this task is distinct from the required PR check (`Secrets, deps, and workflow scan`), which does not run masking — so it does not block PRs, but it does keep the scheduled/full security suite red.

Run `mise run security:sast:masking` on main and inspect the six reported locations: `agent/src/config.py`, `cdk/src/handlers/shared/jira-feedback.ts`, `cli/src/commands/jira.ts`, and `cli/src/commands/linear.ts`. For each finding, determine whether callers need a failure signal or the fallback is intentional degraded-mode behavior. Done means the masking command passes and every retained fallback has a justified inline `nosemgrep` explanation.

Written by the indexing model from the issue text.