Fix assessment docs, ASFF output, and scan suppressions

[agasthik]

Summary

• Make the pipx permissions setup usable without a checkout by downloading the CloudFormation template, and clarify that --dry-run validates AWS access.
• Update the check catalog, architecture, setup, configuration, report, performance, threat model, and troubleshooting docs to match current behavior.
• Give ASFF exports a distinct _asff.json filename so selecting JSON and ASFF together preserves both reports; add a regression test and correct the Security Hub import example.
• Add path-specific ASH B108 suppressions for test fixtures in the local review checkout, and mark the screenshot capture script executable.

Validation

• .venv/bin/python -m pytest -q: 1,211 passed, 3 skipped; 84.11% coverage.
• .venv/bin/ruff check . and .venv/bin/ruff format --check .: passed.
• .ash/ash.yaml parses, and all six B108 findings in the local ASH SARIF output match exactly one new suppression.
• Regenerated the synthetic sample report and both screenshots with the repository scripts; they match the existing committed artifacts.