Integrate SonarQube Cloud analysis and quality badge

[rmcdaniel]

Outcome

Use SonarQube Cloud across the product repositories as a maintained source-quality check, with accurate repository badges and meaningful review of findings.

Acceptance

• Each repository is bound to its corresponding Sonar project; private source and results remain private.
• CI scans the exact checked-out revision, reports its quality gate, and preserves PR comments, annotations and checks.
• Forks receive no analysis credential. Approved actions are pinned, and scanner credentials are scoped to the scan step.
• Sources and tests are classified deliberately; generated files, dependencies and disposable outputs are excluded.
• Coverage is imported when a real report exists; missing coverage is never presented as measured coverage.
• Existing test, release and deployment checks remain required. Valid findings are fixed or explicitly triaged, with no blanket acceptance to manufacture a green gate.
• Readable setup and triage instructions describe the quality profile, gate, notification path and maintenance responsibility.

Server changes are limited to a separately coordinated CI/configuration/README window. No runtime, native/shared fixture, package version or frozen actor change is part of this task.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud