Trivy gates: CRITICAL blocking and gradual rollout

How to land Trivy gates: block CRITICAL first, then canary HIGH by repo and environment, while handling base-image noise and exception TTLs. For DevOps and security ops — sustainable image/dependency vuln gates without freezing builds.