fix: preserve --ci hard-gate exits in JSON mode

[jaruesink]

Summary

anvil audit --json --ci now prints its machine-readable JSON and still exits with the configured hard-gate failure code.

Closes SFD-270.

Verification

• Added a regression test with a failing driftResilience hard gate and configured exit code 7.
• Confirmed JSON remains parseable while the process exits 7.
• bun run lint
• bun run format:check
• bun run typecheck
• bun test — 82 passed, 0 failed.

Review checklist

• The JSON structure is unchanged.
• The non-JSON output path keeps the same hard-gate behavior.
• The shared helper resolves the only substantive review comment.
• No unrelated changes are included.

Follow-up notes

SFD-259's stdout/stderr separation already exists on main; this PR preserves that behavior and only repairs the combined --json --ci exit contract.

[coderabbitai]

📝 Walkthrough

Walkthrough

JSON audit mode now enforces configured hard-gate exit codes after printing its report. A new CLI test creates a hard-gated fixture, verifies exit code 7, and confirms the JSON reports failed hard gates.

Changes

JSON hard-gate enforcement

Layer / File(s)	Summary
Enforce and test JSON hard-gate exits scripts/audit.ts, scripts/audit-cli-mode.test.ts	JSON mode exits with the configured hard-gate code when gates fail. The test sets exit code 7, validates the process result, and checks the JSON hard-gate fields; filesystem imports support temporary fixture setup.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: preserving hard-gate exits in JSON mode.
Description check	✅ Passed	The description matches the template and covers summary, verification, review checklist, and follow-up notes; only minor optional items are missing.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/json-ci-hard-gate-exit

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/audit.ts`:
- Around line 6055-6060: Extract the duplicated hard-gate exit logic from the
JSON and non-JSON branches into a shared helper, then call it from both paths.
Preserve the existing enabled, passed, and exitCode behavior while keeping the
branch-specific output unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: ad407846-5922-45e8-8beb-6860412d736a

📥 Commits

Reviewing files that changed from the base of the PR and between b319ee1 and e180713.

📒 Files selected for processing (2)

• scripts/audit-cli-mode.test.ts
• scripts/audit.ts