ci: make PR gates hermetic and enforce SonarQube

[Claudio9701]

Summary

• replace network-dependent default tests with captured provider responses and synthetic geospatial fixtures
• disable sockets by default and classify live OSM/OSRM checks explicitly
• run the locked suite across Python 3.11-3.14
• add independent correctness, coverage, package, documentation, and dependency-audit checks
• retain SonarQube as a mandatory EL-BID check, remove every best-effort escape hatch, publish real coverage, wait for its quality gate, and upgrade the scanner past its known vulnerable release
• pin every third-party Action to an immutable commit

Validation

• 12 hermetic tests pass with sockets disabled; 2 external tests are deselected by markers
• coverage report generated (30% baseline for ratcheting)
• Sphinx succeeds with warnings treated as errors
• Ruff correctness gate passes
• uv lock check passes
• wheel/sdist and metadata validation pass
• pip-audit reports no known vulnerabilities in the locked environment
• workflow YAML parses cleanly

Stack

Base: #74 (packaging/uv-foundation)
Roadmap: #61

Closes #75
Refs #62, #64