jaah Security Hub Top 5 Fixes

Review Security Hub findings (jaah security account), especially from the standards and fix top 5 that would close the gap the most

Closed the Security Hub top 5: KMS.3 (stale, resolved), GuardDuty CRITICAL attack sequence (2 lineage-pinned suppression rules, 15 findings archived, R-SOC-46), Inspector CRITICAL kernel on both headscale hosts (auto-reboot + rebooted), RDS.23 and CloudFront.4 suppressed (R-SOC-44/45). Live: 0 open failing controls, 0 open GuardDuty. Org root applied by hand. Bastions not rebooted (DNS rides the tailnet; draft 6638); drafts 6636, 6637 filed. Gate full green; PR #5587 merged; Jaah Deploy success. No UI surface affected.