Makes the .github suppressions TRACKED so the Open SWE daily-report automation
(which cannot see ~/.config on the Mac) resolves them: checkov-CKV_AWS_111-88
(permissions-boundary FP) and the accepted-risk checkov-CKV_AWS_109/111-276 on
github-cfn-execution-role.
NOTE: this reverses the earlier out-of-history decision (#61) for this repo, and
:276 is an ACCEPTED-RISK suppression for a REAL (bounded) privesc finding, not an
FP. See PR description. Machine-level copy retained until merge.
