What

Set sonar.qualitygate.wait=true (with a 300s timeout) in sonar-project.properties so the SonarQube Cloud scan step fails the workflow when the project's quality gate is not OK.

Why

Today the scan job reports success regardless of the quality gate result, so a failing gate never fails a check owned by our CI. This mirrors setchy/atlassify#3889, bringing the website in line with atlassify. The gate already scopes to New Code (Clean as You Code), so this only blocks newly introduced issues, not the existing backlog.

Notes

• sonar.qualitygate.timeout=300 is the scanner default and SonarCloud's practical maximum; it is set explicitly for clarity.
• Fork PRs skip the Sonar job (SonarCloud limitation), so fork behaviour is unchanged.
• Adds up to ~5 minutes of gate polling to the Sonar job run.
• This PR is configuration-only (sonar.sources=./src), so it contributes no New Code and should pass the gate itself.
• .github/workflows/sonarcloud.yml is unchanged; the scan action reads sonar-project.properties.

Verification

Planned via the OpenSpec change enforce-sonar-quality-gate:

• Scan step polls the quality gate and the job succeeds when the gate is OK
• Scan step exits non-zero (job fails) when a New Code regression fails the gate

Opened as a draft while the CI behaviour above is confirmed on this PR.