fix(config): clear the CodeQL alerts properly — and undo the one I made worse

[mdheller]

Follow-up to #60, correcting my own fix.

CodeQL re-ran on that fix and reported five high-severity alerts where there had been four. The extra one was mine, and it reached main because CodeQL is not a required check here. Two errors on my side: I dismissed the original failure as a startup fault without opening it, then shipped a fix I had not re-verified.

The tests — I made these worse

I changed 0o644 → 0o640, trading world-readable for group-readable, which CodeQL flags identically. And my new regression test added a second one.

0o700 has no group or world bits at all and is still not 0600 — which is the only thing the tests need to prove: anything but 0600 is refused. Two alerts gone, both assertions unchanged.

The three in config.py — a genuine false positive, now documented

The value CodeQL taints is the secret's name (a key of the secrets mapping), not its value and not its path. A doctor that reports "a secret failed" without saying which one is useless, so the name has to be emitted.

The redaction from #60 stands and is the part that matters: no path, no filename, no secret value reaches the output, and test_doctor_never_echoes_a_secret_path fails if one does.

Each suppression carries its reasoning at the site — including the one on emit, which is a generator, not a reporter: its stdout is the rc file and must carry the reference for the shell to resolve at load.

A suppression with a stated reason and a test behind it is a decision. A suppression without one is a silencer. These are the first kind.