25 pre-existing masking findings on main fail the pre-push gate, forcing --no-verify for every contributor

## Problem

The masking-findings gate fails on **pristine `main`** with 25 pre-existing findings (up from 15 when the #763 work was briefed). Because the gate runs pre-push, every contributor must push with `--no-verify` to land anything — which also skips every *other* pre-push check, so the gate's growth is silently eroding the whole hook.

## Evidence

- Reproduced on a clean checkout of `main` (no branch changes applied): 25 findings.
- PR #763 shipped with `--no-verify` for this gate only; **no `nosemgrep` suppressions were added**, so the findings remain visible.
- The count grew 15 → 25 between the #763 brief and merge, so the backlog is actively accumulating.

## Suggested resolution

1. Triage the 25 findings on `main`: fix the real ones, suppress false positives with justified `nosemgrep` annotations.
2. Once `main` is clean, the gate becomes meaningful again and `--no-verify` stops being the default workflow.
3. Consider a baseline/ratchet mechanism (fail only on **new** findings) if a full cleanup can't land soon, so the gate blocks regressions without blocking unrelated work.

## Origin

Found during PR #763 — see the merge-guidance comment: https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/pull/763#issuecomment-5289889688

Inizia riproducendo il gate di masking-findings su un checkout pulito di main e analizza i suoi 25 findings segnalati, usando come contesto il commento di merge-guidance di PR #763. Classifica ogni finding come reale o false positive, quindi verifica che il gate passi su un main pulito senza --no-verify; se la pulizia non può essere integrata, valuta una baseline o un ratchet che blocchi solo i nuovi findings.

Scritto dal modello di indicizzazione a partire dal testo della issue.