Restore push-time SonarCloud after project quality gate cleanup

## Problem

Main push CI currently fails in the `sonarcloud` job even after lint, lock, clean install, slow tests, and e2e/cross-cutting pass.

Latest observed failing run: https://github.com/Priivacy-ai/spec-kitty/actions/runs/25007722335

SonarCloud project status for `Priivacy-ai_spec-kitty` on `main` reports:

- `new_reliability_rating`: actual 3, threshold 1
- `new_security_rating`: actual 5, threshold 1
- `new_coverage`: 40.8%, threshold 80%
- `new_security_hotspots_reviewed`: 0%, threshold 100%
- 409 unresolved new-code issues since the configured previous-version baseline
- 7 unreviewed security hotspots

The failure is project-wide Sonar backlog, not the e2e fixture/schema compatibility patch. Because the SonarCloud GitHub App posts a failing check when the scan runs, main push CI cannot be fully green while this backlog remains.

## Follow-up

- Review/resolve or explicitly accept the SonarCloud hotspot backlog.
- Fix or suppress the one reported vulnerability and reliability bug.
- Decide whether the previous-version new-code baseline should be reset or kept.
- Re-enable push-time SonarCloud once the project quality gate is expected to pass.

## Temporary CI Hygiene

Until this is fixed, push-time SonarCloud should be quarantined to scheduled/manual runs so normal main CI can reflect repo test/build health without a known unrelated project-wide quality gate failure.