25 pre-existing masking findings on main fail the pre-push gate, forcing --no-verify for every contributor

## Problem

The masking-findings gate fails on **pristine `main`** with 25 pre-existing findings (up from 15 when the #763 work was briefed). Because the gate runs pre-push, every contributor must push with `--no-verify` to land anything — which also skips every *other* pre-push check, so the gate's growth is silently eroding the whole hook.

## Evidence

- Reproduced on a clean checkout of `main` (no branch changes applied): 25 findings.
- PR #763 shipped with `--no-verify` for this gate only; **no `nosemgrep` suppressions were added**, so the findings remain visible.
- The count grew 15 → 25 between the #763 brief and merge, so the backlog is actively accumulating.

## Suggested resolution

1. Triage the 25 findings on `main`: fix the real ones, suppress false positives with justified `nosemgrep` annotations.
2. Once `main` is clean, the gate becomes meaningful again and `--no-verify` stops being the default workflow.
3. Consider a baseline/ratchet mechanism (fail only on **new** findings) if a full cleanup can't land soon, so the gate blocks regressions without blocking unrelated work.

## Origin

Found during PR #763 — see the merge-guidance comment: https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/pull/763#issuecomment-5289889688

Start by reproducing the masking-findings gate on a clean main checkout and review its 25 reported findings, using PR #763's merge-guidance comment as context. Triage each finding as real or a false positive, then verify the gate passes on clean main without --no-verify; if cleanup cannot land, assess a baseline or ratchet that blocks only new findings.

Written by the indexing model from the issue text.