Accept single findings with an allow comment

[tauanbinato]

Left open for review: the comment syntax becomes a public API, so it should be your call before it merges.

What and why

Phase 3 of the roadmap: accept one finding where it is, instead of in jevgate-baseline.json.

# jevgate: allow(hardcoded_values) the protocol fixes this port
PORT = 4222

• Syntax: jevgate: allow(RULE[, RULE…]) reason in any comment style (//, #, /* */, <!-- -->, --). RULE is a rule ID, key or group, as everywhere else. A -, : or — before the reason is dropped.
• Where: on the finding's line (also at its end), or in the block of comment, attribute and decorator lines directly above it, so doc comments and #[attributes] can sit in between; a blank line or code ends the block. For findings with several locations (shared logic), the finding's own line counts.
• Reason required: without one the comment is ignored, and the finding's message says so.
• Effect: the finding stays in the report with suppressed: "<reason>", never fails the gate, is left out of annotations and SARIF, and is counted as gate.suppressed_findings. Agent output shows (allowed: reason). jevgate baseline doesn't copy it, so deleting the comment brings the finding back.
• The comments rule treats jevgate: as a tool directive, so the allow comment is never judged as a comment to clean up.

Questions for review

• Is allow(...) the right verb? Alternatives: ignore, accept.
• Should the reason stay required, or only be counted as missing in baseline stats?

How it was checked

• Parser tests across comment styles, and placement tests (end of line, through doc comments and attributes, stopped by a blank line, wrong rule).
• A whole-run gate test: a review finding fails the gate; with an allow comment and reason it passes and is counted; without a reason, or naming another rule, it still fails.