chore(security): clean up 21 pre-existing silent-success-masking findings on main

## Problem

`mise run security:sast:masking` (the `py/ts-silent-success-masking` rule, AI004 / #257) currently reports **21 un-suppressed findings that already exist on `main`**. Because the check is wired into the **pre-push git hook** and scans the whole repo, every contributor hits this failure on `git push` regardless of what their branch touches — forcing `--no-verify` bypasses (e.g. PR #755).

These are pre-existing: none were introduced by recent feature branches. The full scan reports 79 findings, but 58 carry valid inline `nosemgrep` suppressions and are correctly ignored — only these 21 are genuinely unannotated.

This is separate from the PR-level security gate: `security-pr.yml` only runs secrets/deps/gh-actions, so the masking scan does **not** block PRs — it runs in `security.yml` on push-to-main / schedule. That job is effectively red on `main` for this rule today.

## The 21 findings (file — line)

- `agent/src/clarification_tool.py` — 42
- `agent/src/hooks.py` — 1602
- `agent/src/observability.py` — 86
- `cdk/src/handlers/github-webhook-processor.ts` — 448
- `cdk/src/handlers/jira-webhook-processor.ts` — 1530
- `cdk/src/handlers/linear-webhook-processor.ts` — 532, 2757, 3057, 3108
- `cdk/src/handlers/orchestration-reconciler.ts` — 471, 1455, 1476
- `cdk/src/handlers/shared/jira-feedback.ts` — 372, 395
- `cdk/src/handlers/shared/linear-feedback.ts` — 280
- `cdk/src/handlers/shared/linear-subissue-fetch.ts` — 333
- `cdk/src/handlers/shared/orchestration-rollup.ts` — 490
- `cdk/src/handlers/shared/orchestration-store.ts` — 344
- `cdk/src/handlers/shared/slack-api.ts` — 112
- `cli/src/commands/linear.ts` — 1721
- `cli/src/linear-oauth.ts` — 382

## Fix

For each line, do one of (per the rule's own guidance):
1. Add a justified inline `# nosemgrep: -- ` on the return line, **or**
2. Re-raise / return a result shape that encodes the failure, if the swallow is actually a bug.

Most look like intentional best-effort/feature-detect fallbacks (e.g. `except ImportError: return None` for optional SDK; optional GitHub/Jira/Linear fetches returning null) → option 1. Each should be reviewed on its merits, not blanket-annotated.

## Optional follow-up

Consider scoping the pre-push masking hook to the push diff rather than the whole repo, so contributors stop being blocked by untouched debt. That is a gate-semantics change and should be discussed separately.

Surfaced while addressing the PR #755 review (issue #641).