fix: treat dev cd artifact audits as non-blocking

scripts/src/dev-cd-apply.mjs

@@ -730,6 +730,19 @@ function validateArgs(args) {
   }
 }
 
+function artifactBoundaryRequiresApplyBlock(target) {
+  if (target.publishRequired !== false) return false;
+  if (target.artifactBoundary?.status !== "degraded") return false;
+
+  const desiredState = target.artifactBoundary.desiredState ?? {};
+  const desiredStateCheckPass = target.desiredStateCheck?.status === "pass";
+  const releaseGatePinsMatch =
+    desiredState.deployCommitMatches === true &&
+    desiredState.catalogCommitMatches === true;
+
+  return !(desiredStateCheckPass && releaseGatePinsMatch);
+}
+
 function lockAnnotationValue(value) {
   if (value === undefined || value === null) return "";
   if (typeof value === "string") return value;
@@ -2534,22 +2547,23 @@ export async function runDevCdApply(argv, io = {}) {
     const artifactEvidence = await readArtifactEvidence(ctx.repoRoot);
     target = await resolveEffectiveTarget(ctx, args, deployBefore, artifactEvidence);
     if (target.desiredStateCheck?.status === "blocked") {
+      blockers.push({
+        type: "contract_blocker",
+        scope: "desired-state-promotion",
+        status: "open",
+        summary: "deploy/deploy.json is not aligned with the target ref, and the deploy-json promotion check did not pass."
+      });
       throw new DevCdApplyError("deploy desired-state does not match the target ref or a published deploy.json promotion", {
         code: "desired-state-promotion-check-failed",
-        blockers: [{
-          type: "contract_blocker",
-          scope: "desired-state-promotion",
-          status: "open",
-          summary: "deploy/deploy.json is not aligned with the target ref, and the deploy-json promotion check did not pass."
-        }]
+        suppressCatchBlocker: true
       });
     }
-    if (target.publishRequired === false && target.artifactBoundary?.status === "degraded") {
+    if (artifactBoundaryRequiresApplyBlock(target)) {
       blockers.push({
         type: "contract_blocker",
         scope: "artifact-boundary",
         status: "open",
-        summary: "deploy/deploy.json, deploy/artifact-catalog.dev.json, deploy/k8s/base/workloads.yaml, and the artifact merge parent must resolve to the same promotion commit before apply."
+        summary: "deploy/deploy.json, deploy/artifact-catalog.dev.json, deploy/k8s/base/workloads.yaml, and registry manifests must prove the same promotion commit before apply."
       });
       throw new DevCdApplyError("artifact desired-state provenance does not match the deploy.json promotion", {
         code: "artifact-boundary-provenance-mismatch",