Pre-existing `pre-commit run --all-files` failures (tracking)

## Summary

`pre-commit run --all-files` currently fails on a clean checkout of `main` (verified at commit `7a17df7`). CI does **not** run the full pre-commit suite — it runs `mise run build` — so these failures are latent and only surface when a contributor runs the hooks locally. This is a tracking issue for the distinct, independent failures; each root cause has its own issue with details and a proposed fix.

## Why this matters

Contributors who install the git hooks (`pre-commit install`) or run `mise run pre-commit` hit failures unrelated to their change, which trains people to bypass hooks with `--no-verify`. Fixing these restores a clean local signal.

## How to reproduce

```bash
git checkout main
mise exec -- pre-commit run --all-files
```

## Per-hook results on clean `main`

| Hook | Result | Root cause |
|------|--------|-----------|
| `check-ast`, `check-builtin-literals`, `debug-statements`, `ruff-format` | Failed | 12 `code_templates/*.py` are intentionally non-runnable and don't parse |
| `check-executables-have-shebangs` | Failed | 6 `.md` files carry the executable bit |
| `check-shebang-scripts-are-executable` | Failed | 2 `.py` scripts have a shebang but no executable bit |
| `check-json` | Failed | `aws4-shapes.json` has a duplicate key (`iot`) |
| `check-vcs-permalinks` | Failed | non-permalink `github.com/.../blob/main/...` URLs in 2 docs |
| `ruff-check` | Failed | real lint errors (F841/E402/F821) in non-template `.py` files |
| `bandit` | Failed (exit 2) | references a missing `.bandit-baseline.json` |
| `no-commit-to-branch` | Failed | **not a bug** — only "fails" because the reproduction runs on `main`; the hook exists to block that. Excluded. |

Sub-issues are linked in the comments below.

_{Filed with assistance from Claude Code while implementing #211.}

Run `mise exec -- pre-commit run --all-files` on clean `main` and use the per-hook table to choose one independent failure or its linked sub-issue. Inspect the named `code_templates/*.py`, `.md` files, `.py` scripts, `aws4-shapes.json`, documentation URLs, lint errors, or `.bandit-baseline.json` as applicable. Done means the selected root cause is fixed and the relevant hook passes without treating `no-commit-to-branch` as a bug.

Written by the indexing model from the issue text.