fix(ci): preserve current Kova gate failures (#126034)

scripts/lib/kova-report-gate.mts

@@ -758,6 +758,7 @@ export function evaluateToleratedProfiledKovaReport(
   return evaluate(() => {
     const { gate, records, cards, groups } = validateEnvelope(report, options);
     check(gate.verdict === "DO_NOT_SHIP", "gate verdict was not DO_NOT_SHIP");
+    check(!options.requireInstrumentedPerformanceContract, "current producer retained failure");
     check(
       records.every((record) => record.status === "PASS" || record.status === "FAIL"),
       "invalid record status",

test/scripts/kova-report-gate.test.ts

@@ -703,6 +703,18 @@ describe("scripts/lib/kova-report-gate.mts", () => {
     });
   });
 
+  it("rejects deep-profile failures from the current producer contract", () => {
+    expect(
+      evaluateToleratedProfiledKovaReport(
+        profiledResourceReport(),
+        STRICT_INSTRUMENTED_PERFORMANCE_OPTIONS,
+      ),
+    ).toEqual({
+      ok: false,
+      reason: "current producer retained failure",
+    });
+  });
+
   it("accepts independently matching non-regressing baseline evidence", () => {
     const partial = partialReport();
     const profiled = profiledResourceReport();
@@ -1326,6 +1338,21 @@ describe("scripts/lib/kova-report-gate.mts", () => {
     expect(result.stdout).toContain("profiled-resource-only");
   });
 
+  it("keeps current-producer deep-profile failures non-zero at the CLI boundary", () => {
+    const result = spawnSync(
+      process.execPath,
+      [
+        SCRIPT_PATH,
+        writeReport(profiledResourceReport()),
+        "--require-instrumented-performance-contract",
+      ],
+      { cwd: process.cwd(), encoding: "utf8" },
+    );
+
+    expect(result.status).toBe(1);
+    expect(result.stderr).toContain("current producer retained failure");
+  });
+
   it("keeps required instrumented PARTIAL evidence non-zero at the CLI boundary", () => {
     const report = partialReport();
     attachInstrumentedPerformanceWarning(report);