ci: simplify Sonar scanning

[aksOps]

What changed

• replace the two-stage Sonar artifact relay with one quality workflow
• run the workflow only for pull requests targeting main and pushes to main
• run frontend and Go coverage, build, vet, race tests, formatting, then the official SonarQube Cloud action
• remove the custom protected scanner action and its control-plane validation helpers
• keep immutable action pins and skip tokened scanning for fork pull requests

Why

The existing pipeline split coverage generation and scanning across two workflows, then added artifact manifests, candidate-tree validation, protected control-plane checkouts, and custom Sonar compute-task verification. Recent main-branch history showed repeated failures in that machinery. The official Sonar action supports the required PR/main trigger directly.

Validation

• Actionlint passed
• Shellcheck passed
• 902 frontend tests passed
• frontend branch coverage: 95.21%
• Go statement coverage: 96.4%
• 894 Go race-tested cases passed
• frontend build passed
• go vet ./... passed
• Go formatting check passed
• immutable action pin check passed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud