Review and fix top Security Hub findings

Review Security Hub findings (jaah security account), especially from the standards and fix top 5 that would close the gap the most

Security Hub review 2026-11-01: 25 open findings → 11, failed FSBP controls 11 → 8, product findings 11 → 0. Top 5 closed: apps account's 8 Access Analyzer findings (stale archive rules applied), 2 GuardDuty R-SOC-46 residuals triaged, 4 yumapos-boss by-design findings (rules 23–25, R-SOC-60/61), SSM.3 root-caused to an OOM hosting node (draft 12152, R-SOC-63), the rest tracked (R-SOC-62/64). Quick gate, terraform test, 3 review lanes green. PR #7566 queued in the merge lane. No UI surface. Deferred: yumapos-boss/sales real fixes, node capacity, owner's full org apply.