fix(ci): establish protected Sonar baseline

[aksOps]

Summary

• classify repository tests separately from production sources in Sonar
• keep CI/control-plane files statically analyzed while excluding them from the application coverage denominator
• establish a one-time stable 0.1.0-sonar.1 Clean-as-You-Code baseline
• enforce parity between protected scanner arguments and repository properties

Verification

• 877 frontend tests passed; coverage 98.22% statements, 95.20% branches, 98.71% functions, 99.42% lines
• Go package floors passed: 98.3%, 100.0%, 99.7%, 99.0%, 95.1%, 95.6%; aggregate 96.4%
• build, vet, race, formatting, ShellCheck, actionlint, hostile artifact/workflow tests, and diff checks passed
• independent coverage review APPROVE; Architect CLEAR; Code Reviewer APPROVE

Bootstrap note

The protected workflow_run scanner reads its configuration from current main, so this maintenance PR cannot apply its own baseline/scope correction before merge. A red Sonar result on this PR is the recorded one-time bootstrap condition; every non-Sonar gate remains mandatory. After merge, the protected main scan must report the exact merge revision, application coverage above 95%, and a passing quality gate before capability enforcement continues.

The organization-level SONAR_TOKEN remains shared and unchanged. The sonar-scan environment is only a main-only job boundary.

[sonarqubecloud]

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 95%)

See analysis details on SonarQube Cloud

[aksOps]

Bootstrap exception evidence for exact head 5f460fb965ab2611d49922e976ed1fceb116ed8e:

• Push and pull-request regression runs succeeded, including 877 frontend tests, all Go package coverage floors, 96.4% aggregate Go coverage, build, vet, race, formatting, Actionlint, ShellCheck, immutable action pins, and hostile CI tests.
• Candidate coverage artifacts were generated and bound to the exact head on both runs.
• CodeQL and Socket checks succeeded.
• Sonar PR analysis completed on the exact head with zero new issues. Its quality gate failed only new_coverage=0.0% because the protected scanner is sourced from current main and still classifies this maintenance test file as production coverage. This PR is the isolated scope/baseline correction for that defect.
• Independent Code Reviewer: APPROVE. Independent Architect: CLEAR under the recorded G011 one-time bootstrap exception.
• SONAR_TOKEN remains organization-shared and unchanged.

Merge remains conditional on the completed push-side scan evidence and mandatory exact-revision verification on main after merge. Remediation does not begin until the strict G012 ruleset is installed.