fix(devskim): use inline ignores for hash command patterns

Revert the MegaLinter-level DevSkim suppression and add targeted inline DevSkim ignore comments on md5sum and sha1sum permission patterns.

Made-with: Cursor

Author: ChipWolf

.mega-linter.yml

@@ -5,8 +5,3 @@ DISABLE:
 SARIF_REPORTER: true
 
 LUA_LUACHECK_ARGUMENTS: "--globals vim"
-
-# DevSkim flags literal md5sum/sha1sum strings in this policy data file as
-# banned hash algorithm usage, but these are command-permission patterns, not
-# cryptographic implementations.
-REPOSITORY_DEVSKIM_FILTER_REGEX_EXCLUDE: home/.chezmoidata/agent-permissions/00-base.yaml

home/.chezmoidata/agent-permissions/00-base.yaml

@@ -183,10 +183,12 @@ agentPermissions:
       op: allow
       bashMatchMode: withArgs
     - kind: bash
+      # DevSkim: ignore DS0000
       pattern: "md5sum"
       op: allow
       bashMatchMode: withArgs
     - kind: bash
+      # DevSkim: ignore DS0000
       pattern: "sha1sum"
       op: allow
       bashMatchMode: withArgs