fix(ci): remove the unrunnable SonarCloud step breaking Governance + CodeQL (#139)

## What

Removes `SonarSource/sonarqube-scan-action@master` from four workflows.
This single unpinned action is the **sole cause of both remaining red
checks on `main`**.

## Why both checks are red

| Check | Error |
|---|---|
| `governance / Workflow security linter` | `ERROR: Found unpinned
actions:`<br>`.github/workflows/codeql.yml:58: uses:
SonarSource/sonarqube-scan-action@master` |
| `CodeQL Security Analysis` | `##[error]The action
sonarsource/sonarqube-scan-action@master is not allowed in
hyperpolymath/maa-framework because all actions must be pinned to a
full-length commit SHA.` |

The CodeQL one is a **startup rejection** by the org ruleset — the
`analyze` job died with zero steps executed. No lint-shaped error, and
nothing useful in `gh pr checks`.

## Why removed, not pinned

Pinning alone cannot make this step work. Measured:

- **No `SONAR_TOKEN` secret** on this repo (`gh secret list` — 8
secrets, none is Sonar)
- **No sonar config** anywhere in the tree (`git ls-tree -r origin/main
| grep -i sonar` → empty)
- **No `with:` or `env:`** on the step, so no project key and no
organization
- It was appended **inside the CodeQL matrix job**, so it would run once
per language
- In two files it was jammed between a step and the next job key **with
no blank line**

Pinning would have swapped a pinning error for an auth error and left
`main` red.

## Scope

| File | Status |
|---|---|
| `.github/workflows/codeql.yml` | **live** — this is the one breaking
CI |
| `aletheia/.github/workflows/codeql.yml` | inert |
| `aletheia/.github/workflows/rust-ci.yml` | inert |
| `aletheia/extraction/rhodibot/.github/workflows/ci.yml` | inert |

The three `aletheia/` copies are inert because **Actions reads
`.github/workflows/` at the repository root only** — that subtree has
never executed. They are removed anyway so the defect cannot return the
moment anyone promotes one of those files to the root. Trailing newlines
the sweep dropped are also restored.

## Verification

- All four files parse — `yq eval '.jobs | keys'`
- Job keys intact — `test,security,coverage` and
`check,test,build,self-verify`
- Governance linter replicated locally: `All actions are SHA-pinned` +
`All workflows have SPDX headers + permissions`

## Adopting SonarCloud properly later

One root workflow only, pinned to a SHA, with `SONAR_TOKEN` wired and a
`sonar-project.properties` committed. Note the estate finding that a
minted repo's `sonar.projectKey` can still point at the template's Sonar
project.

## Not in this PR

- **#124 / #125** (aletheia CLI + clippy) — blocked on a product
decision about the source of truth for RSR checks
- The `squisher-corpus` `guix.scm` clobber — **not on `origin/main`**;
`origin/main`'s copy is correct. Local-only, handled separately.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -53,6 +53,3 @@ jobs:
         uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3
         with:
           category: "/language:${{ matrix.language }}"
-
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@master

aletheia/.github/workflows/codeql.yml

@@ -40,6 +40,3 @@ jobs:
         uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.28.1
         with:
           category: "/language:${{ matrix.language }}"
-
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@master

aletheia/.github/workflows/rust-ci.yml

@@ -28,8 +28,6 @@ jobs:
       - name: Build release
         run: cargo build --release
 
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@master
   security:
     runs-on: ubuntu-latest
     timeout-minutes: 15

aletheia/extraction/rhodibot/.github/workflows/ci.yml

@@ -45,8 +45,6 @@ jobs:
             exit 1
           fi
 
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@master
   test:
     name: Test
     runs-on: ubuntu-latest