ci: bootstrap protected sonar scanning

[aksOps]

Summary

• enforce frontend and Go coverage floors in an unprivileged regression workflow
• publish revision-bound coverage artifacts for a protected workflow_run Sonar consumer
• harden the consumer against candidate-code execution, artifact substitution, revision drift, symlinks, gitlinks, and control-plane changes
• add CODEOWNERS and hostile tests for the CI trust boundary

Zero-regression evidence

• frontend: 64 files, 875 tests
• coverage: 98.20% statements, 95.07% branches, 98.71% functions, 99.42% lines
• Go: every package at least 95%; aggregate 96.4%
• build, go vet, go race, tracked Go formatting, actionlint, shellcheck, action pinning, workflow structure, hostile artifact validation, and archive install tests passed locally
• commit 0de5855 has a valid SSH signature

Bootstrap exception

The protected Sonar workflow_run consumer cannot execute from this pull request because GitHub resolves workflow_run definitions from the default branch. This PR must pass every available non-Sonar gate and independent review. After merge, the exact main revision will be verified and the protected Sonar producer/consumer path will be exercised before remediation begins.

No product source files are changed.