Add a maintainer-run workflow to check 3rd-party integration connectivity (SonarCloud/Codecov) #208

Problem

When a Sonar/Codecov step fails, it is hard to tell a bad/expired token apart from a code or network problem. This actually happened: the fork Sonar publish failed with HTTP 403 ... check SONAR_TOKEN — the whole pipeline (approval → checkout → restore) worked, only the token was rejected by SonarCloud. A full CI run is a slow, noisy way to discover that.

Proposal

Add a small maintainer-only workflow_dispatch workflow (e.g. integrations-check.yml) that verifies the configured integration secrets and endpoint reachability in a few seconds, without building or running any project/PR code:

• SonarCloud — confirm SONAR_TOKEN is present and valid via GET https://sonarcloud.io/api/authentication/validate (token sent as HTTP basic auth; its value is never printed). Fails clearly on 403/"valid":false.
• Codecov — confirm CODECOV_TOKEN is present and that the Codecov API is reachable. (Codecov upload tokens have no public "validate" endpoint, so this is presence + reachability, which is stated honestly in the output.)

An input lets the maintainer pick all / sonarcloud / codecov.

Why this is safe

• workflow_dispatch can only be started by users with write access, from the default branch — so it is inherently maintainer-gated and never runs for fork PRs.
• It executes no build and no PR-supplied code; it only performs authenticated HTTP checks. Token values are never echoed.

Not in scope

• It does not replace the fork fork-ci environment approval for the actual Sonar publish; it is purely a diagnostic.