ci: fail pull requests with new Sonar issues

[jamessawle]

Problem

SonarQube Cloud currently uses the built-in Sonar way quality gate. It can report newly introduced issues while still passing the gate because maintainability remains rated A. PR #87 demonstrated this with three new critical maintainability findings and a passing quality gate.

Scope

• Determine whether the current SonarQube Cloud plan supports a project-specific custom quality gate.
• If supported, configure a gate that fails when New issues > 0 while retaining the existing security, reliability, maintainability, hotspot, coverage, and duplication conditions.
• If it is not supported, add a repository-owned required CI check that waits for the matching Sonar analysis and fails when it reports any new open or confirmed issue.
• Make any bypass explicit, auditable, narrowly scoped, and documented; do not silently accept new issues.
• Keep branch protection and contributor documentation aligned with the selected enforcement mechanism.

Acceptance criteria

• A pull request introducing any new Sonar issue fails a required check by default.
• An allowed exception requires an explicit, visible bypass with a recorded reason.
• CONTRIBUTING.md documents the quality check.
• mise run validate passes.

Context

• Follow-up from refactor(tests): split high-complexity CLI and lifecycle test functions #79 and PR refactor(tests): split complex lifecycle scenarios #87.
• The repository currently has no SONAR_TOKEN Actions secret and uses Sonar automatic analysis.
• The unauthenticated Sonar API exposes only the built-in Sonar way gate; custom-gate availability must be confirmed against the organization plan.
• Go coverage reporting is tracked separately.

[jamessawle]

Coverage reporting and Sonar coverage import have been split into #90.