[W2] Deterministic CI, Trunk, SonarQube, and required checks

[Claudio9701]

Outcome

Every PR receives one deterministic, enforceable quality result while SonarQube remains mandatory for EL-BID.

Parent tasks

• replace live PR tests with hermetic fixtures and network blocking
• split and harden workflows, pin Actions, and remove duplicate runs
• make coverage and SonarQube quality-gate failures blocking
• evaluate Trunk Code Quality with standard-tool fallbacks
• require CI, SonarQube, security/compliance, one human review, and thread resolution

Acceptance

The default branch cannot merge a PR with failing required checks or without human approval.

Plan: PR #61