Two checks that disagree
When one gate says pass and another says fail, the interesting question is what each of them can see.
A deploy gate reported everything in order. A separate audit found four problems in the same tree. Both were run correctly and both were honest.
They disagreed because they were looking at different things: one walked the files the build manifest named, the other walked the files on disk. The manifest did not name everything on disk, and disk did not carry everything the manifest named.
When two checks disagree, do not pick the one you like. Work out what each one is blind to, and then build the check that is blind to neither.