[Maintenance] Validate Sonar administration and continue CI efficiency review #402

Purpose

This focused successor preserves the optional analysis/CI follow-up from #324 without keeping the completed modernization tracker open. Existing controls remain authoritative while this is evaluated: no new Sonar or CodeQL finding is ignorable, the exact-head repository gate must stay green, and CI speed may not be improved by reducing coverage or quality.

Sonar decision

• Determine whether SonarCloud Automatic Analysis now provides every capability the repository actually needs alongside Codecov: correct monorepo source/test/generated boundaries, authoritative aggregate and changed-code coverage, exact PR-head attribution, stable required status, fork safety, and no duplicate analysis.
• If it is equivalent, record evidence and close the administration switch as unnecessary.
• If it is not equivalent and administration is available, prepare the controlled CI scan using existing aggregate LCOV/report paths, least-privilege token handling, and the precise generated/third-party ownership registry.
• Disable Automatic Analysis before enabling CI analysis so duplicate scans cannot race or disagree.
• Validate main and pull-request coverage ingestion, new-code definition, path mapping, fork behavior, check naming, and exact-head zero-finding/hotspot enforcement before changing repository rules.
• Keep accepted/false-positive new issues and unreviewed hotspots fail-closed under the repository-owned policy regardless of Sonar’s aggregate badge.

CI efficiency

• Re-measure representative full and targeted cohorts using Actions-supported run, job, step, queue, artifact, and variance data.
• Do not restore unsupported CPU, memory, or action-internal cache-hit instrumentation; GitHub-hosted Actions APIs do not expose reliable values for those fields.
• Profile repeated checkout/setup/install/build, artifact transfer, coverage aggregation/upload, browser/mobile, mutation, container, and external-service latency from actual hosted runs.
• Improve graph-aware scope selection, safe build reuse, deterministic sharding, cache keys, artifact boundaries, and concurrency only where the same assertions, analysis, runtime profiles, and security isolation remain intact.
• Retain full-fanout triggers for root toolchain, CI orchestration, SDK, governance, coverage, and other changes whose blast radius requires the whole stack.
• Compare median/p95 and failure/retry behavior against governed baselines; reject optimizations that merely move work outside the measured merge gate or make failures harder to diagnose.
• Update governance/ci-performance-baseline.json, docs, and workflow comments only from measured evidence.

Exit

Close after the Sonar path has an explicit evidence-backed disposition and the next material CI efficiency review has either landed safe improvements or documented that remaining cost is required. All changed workflow heads must pass the complete exact-head gate, CodeQL, Sonar zero findings/hotspots, and main verification.