chore: add SonarCloud analysis (#49)

Adds `sonar-project.properties`, a standalone
`.github/workflows/sonarcloud.yml` (SonarSource/sonarqube-scan-action,
SHA-pinned), and a README quality-gate badge. Mirrors the boj-server
reference setup.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/sonarcloud.yml

@@ -0,0 +1,30 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# SonarQube Cloud (SonarCloud) static analysis. Analysis scope + exclusions
+# live in sonar-project.properties. Requires the SONAR_TOKEN repository secret
+# (Settings -> Secrets and variables -> Actions).
+name: SonarCloud
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened]
+permissions:
+  contents: read
+jobs:
+  sonarqube:
+    name: SonarQube
+    runs-on: ubuntu-latest
+    env:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
+      # Skips cleanly (job stays green) until the SONAR_TOKEN secret is added;
+      # analysis activates automatically once the token is present.
+      - name: SonarQube Scan
+        if: env.SONAR_TOKEN != ''
+        uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0

EXPLAINME.adoc

@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: CC-BY-SA-4.0
 // Copyright (c) 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 = [quantum (sic)] DNS Fluctuator — Show Me The Receipts
+
+image:https://sonarcloud.io/api/project_badges/quality_gate?project=hyperpolymath_resource-record-fluctuator[Quality gate,link=https://sonarcloud.io/summary/new_code?id=hyperpolymath_resource-record-fluctuator]
 :toc:
 :icons: font
 :author: Jonathan D.A. Jewell

README.adoc

@@ -1,6 +1,7 @@
 = [quantum (sic)] DNS Fluctuator
 
 image:https://img.shields.io/badge/license-PMPL--1.0-blue.svg[License,link="https://github.com/hyperpolymath/palimpsest-license"]
+image:https://sonarcloud.io/api/project_badges/quality_gate?project=hyperpolymath_resource-record-fluctuator[Quality gate,link=https://sonarcloud.io/summary/new_code?id=hyperpolymath_resource-record-fluctuator]
 
 // SPDX-License-Identifier: CC-BY-SA-4.0
 // SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell

sonar-project.properties

@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: MPL-2.0
+# SonarQube Cloud (SonarCloud) configuration.
+# Project: https://sonarcloud.io/project/overview?id=hyperpolymath_resource-record-fluctuator
+sonar.organization=hyperpolymath
+sonar.projectKey=hyperpolymath_resource-record-fluctuator
+
+# Estate-default analysable surface. Vendored, generated, build, proof, and
+# dependency trees are excluded so findings stay signal-rich. SonarCloud
+# silently ignores patterns that match nothing in a given repo.
+sonar.exclusions=**/node_modules/**,**/build/**,**/dist/**,**/_build/**,**/deps/**,**/target/**,**/vendor/**,**/generated/**,**/.lake/**,external_corpora/**,proofs/**,verification/**,**/*.idr,**/*.zig,**/*.agda,**/*.lean,**/*.lagda
+sonar.coverage.exclusions=**/*test*,**/tests/**,**/*.spec.*