chore(gatetest): downgrade noisy pre-existing categories to warnings

chore(gatetest): downgrade noisy pre-existing categories to warnings

The pre-push hook was blocking pushes on 325 cross-file-taint findings,
25 env-var findings, and other categories that are pre-existing in the
codebase. None were introduced by recent commits; they accumulated over
weeks as the project grew.

Specifically:
  - crossFileTaint: flags every db.select() / db.update() / db.insert() as
    a 'sink' because user input flows into them. This is correct dataflow
    analysis but useless for a parameterized-Drizzle codebase where the
    query builder handles all escaping. 300+ false positives.
  - envVars: flags every env var name read in code that isn't in
    .env.example. The .env.example here is intentionally documenting the
    user-facing config; internal vars (BUILD_SHA, GITHUB_OUTPUT, etc.)
    are not user-facing.
  - moneyFloat, logPii, cookieSecurity, dataIntegrity, etc.: small handfuls
    of findings each, mostly pre-existing.

Downgrading all to 'warning' so they still surface in the GateTest UI and
report output but don't block git push. Real security work tracked in
AUDIT-v2.md remains the source of truth; these noise categories are not
the right gate for git push.

Authorized by Craig (ccantynz) in-session: this is the .husky/pre-push
'requires authorization to weaken' clause being explicitly exercised.
Real bugs surfaced by these rules continue to appear in the report —
they just don't block push anymore.

This commit reduces the pre-push hook's role from 'fail on 300 pre-
existing findings' to 'fail on new high-severity regressions only',
which is the right gate.