chore: fix findings from a full repo scan

[DustyStudy]

What and why

Follow-up to #12 from a full repo scan (secrets incl. full git history, dependency CVEs, actionlint, pinned-SHA verification, Checkov/tfsec/tflint/ruff/bandit, cfn-lint incl. informational rules, an IAM permission-surface review, and the real seed.py run against an emulated AWS). The code is clean; this PR fixes the three small in-repo findings.

• Removes a dead Checkov skip. CKV_AWS_273 suppressed nothing (verified by removing it: still 0 failures).
• Corrects the CKV2_AWS_10 skip explanation. The comment blamed unresolved variables; supplying real values with --var-file did not change the result. It is a graph check that needs the log group to be an aws_cloudwatch_log_group resource in the same config, and here it is deliberately external. The skip is valid; the stated reason was wrong.
• States DeletionPolicy/UpdateReplacePolicy explicitly on the DynamoDB lock table (cfn-lint I3011), with a regression test. The state bucket stays Retain; the lock table holds only transient records, so Delete is a decision rather than an omission.

Risk

Low. No IAM, trust or runtime behaviour changes; the lock table's effective behaviour is unchanged (CloudFormation's default was already Delete).

Verification

pytest 59 passed; cfn-lint clean at default and with informational rules; Checkov 0 failed; ruff/bandit/gitleaks/actionlint clean; terraform fmt/validate/test on 1.9.0 pass; 21/21 checks passing for the real seed.py against moto.

Not in this PR (deliberately)

Design choices flagged in the scan report: OrgSeedAdmin self-modification (documented in SECURITY.md), TerraformCI reach over all SCPs in the org, and state-bucket access logging. GitHub-side settings (the orgseed Environment, required status checks) are configured in repo settings, not in this diff.