25 pre-existing masking findings on main fail the pre-push gate, forcing --no-verify for every contributor

## Problem

The masking-findings gate fails on **pristine `main`** with 25 pre-existing findings (up from 15 when the #763 work was briefed). Because the gate runs pre-push, every contributor must push with `--no-verify` to land anything — which also skips every *other* pre-push check, so the gate's growth is silently eroding the whole hook.

## Evidence

- Reproduced on a clean checkout of `main` (no branch changes applied): 25 findings.
- PR #763 shipped with `--no-verify` for this gate only; **no `nosemgrep` suppressions were added**, so the findings remain visible.
- The count grew 15 → 25 between the #763 brief and merge, so the backlog is actively accumulating.

## Suggested resolution

1. Triage the 25 findings on `main`: fix the real ones, suppress false positives with justified `nosemgrep` annotations.
2. Once `main` is clean, the gate becomes meaningful again and `--no-verify` stops being the default workflow.
3. Consider a baseline/ratchet mechanism (fail only on **new** findings) if a full cleanup can't land soon, so the gate blocks regressions without blocking unrelated work.

## Origin

Found during PR #763 — see the merge-guidance comment: https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/pull/763#issuecomment-5289889688

Beginne damit, den masking-findings-Gate in einem sauberen main-Checkout zu reproduzieren und seine 25 gemeldeten Findings zu prüfen, wobei du den Merge-Hinweis aus PR #763 als Kontext verwendest. Triage jedes Finding als tatsächlichen Befund oder False Positive und verifiziere anschließend, dass der Gate auf einem sauberen main ohne --no-verify erfolgreich ist; falls die Bereinigung nicht integriert werden kann, bewerte eine Baseline oder einen Ratchet, der nur neue Findings blockiert.

Vom Indexierungsmodell aus dem Issue-Text verfasst.