Review and fix Security Hub findings

Review Security Hub findings (jaah security account), especially from the standards and fix top 5 that would close the gap the most

Reviewed the security account's Security Hub: all 99 failed FSBP/CIS findings were already accepted-risk suppressions, no open failed control. Closed the 10 open findings (8 Access Analyzer on the sales CI role, 2 Macie on the website buckets) with Terraform-managed dispositions applied live, added the role to the trust-change watch, closed R-SOC-58 on evidence. 0 NEW findings. PR #7318 merged; Jaah Deploy succeeded. Deferred: a durable rule for the status page's hand-suppressed Macie finding. Memory: none applied; proposed 1 gotcha.