audit critical metric (blocking: 'zero') ignores the baseline value

[rafaelvieiras]

Problem

audit_critical uses blocking: 'zero', which fails whenever the current count is > 0, regardless of the baseline. There is no way to encode a known/accepted critical vulnerability — the gate hard-blocks even when there is no regression relative to the baseline.

Location

scripts/quality-gate.mjs / src/generators/gate-script.mjs (METRIC_DEFS + the blocking === 'zero' branch in compareMetrics)

Suggested fix

Optionally allow a ratchet-against-baseline mode for audit (fail only on increase vs baseline), or a documented allowlist, while keeping zero-tolerance as the default.

Acceptance

• Projects with an accepted baseline critical can ratchet without permanently red CI; default stays zero-tolerance.