ci: add Sonar scan workflow

[aksOps]

Summary

• Add Sonar scan workflow for pull requests targeting main and pushes to main.
• Add sonar-project.properties for the Rust TUI package.
• Preserve existing main-branch checks by only adding a new workflow.

Verification

• ruby -e "require 'yaml'; YAML.load_file('.github/workflows/sonar.yml')": passed
• cargo fmt --check: passed
• cargo test --locked: 210 passed
• cargo build --release --locked: passed
• node --check bin/lane.js: passed
• npm pack --dry-run: 17 files, 76.9 kB
• Sonar predictor: no issues
• Reviewer pass: no findings

Notes

• Requires SONAR_TOKEN repository/organization secret.
• Forked PRs skip the Sonar job because GitHub does not expose secrets to fork PR workflows.
• Uses SonarCloud default host; sonar.organization is randomcodespace and sonar.projectKey is RandomCodeSpace_lane.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud