Review and fix AWS Security Hub findings

Review Security Hub findings (jaah security account), especially from the standards and fix top 5 that would close the gap the most

Security Hub review: standards show no open gap (93 FAILED, all owner-accepted suppressions; 386/386 controls Passed). Only open findings were 2 CRITICAL Inspector brotli hits in the prod canary's AWS runtime layer: pinned suppression rule R-SOC-55 added and applied live in both regions; Security Hub now 0 open. Top-5 suppressed groups kept per recorded owner decisions. 3 org-root drift changes left for the owner's next apply. PR #6843 queued in the merge lane. Memory: proposed 1 gotcha.