fix(ci): repair code quality workflow paths

[kvithayathil]

What & why

Fixes the nightly Code Quality Analysis workflow, which was hard-failing at setup time. Three bugs, three commits. Tracking issue: #54.

Changes

1. Invalid main/ path prefixes (89da206)

main/ path prefixes and working-directory: main directives were introduced in 610848b. GitHub Actions checks out the repo at the workspace root — there is no main/ directory, so backend/ and frontend/ live at the checkout root.

• cache-dependency-glob: "main/backend/uv.lock" → "backend/uv.lock"
• Removed 8× working-directory: main
• sarif_file: main/frontend/fallow-results.sarif → frontend/fallow-results.sarif
• Removed main/ prefixes from 5 artifact paths

2. Wrong jscpd report filename (e50d92f)

The quality-thresholds step looked for jscpd-report/index.html, but jscpd writes jscpd-report/jscpd-report.html (per the justfile duplication recipe). Without the file the step emitted ::error::jscpd report not found and failed.

3. jscpd duplication-percentage parse bug (5c077d2)

The thresholds step grepped \d+(?=%) and took the first match, which was 100 from the report's CSS (width: 100%) — a false positive that tripped the 20% gate every run. The real duplication rate is 2.20%.

• Scope the grep to the "Duplicated Lines" stat card so only the real rate is matched.
• Switch the threshold check from bash integer -gt to awk so decimal percentages (e.g. 2.20%) compare correctly. The previous [ "$DUP_PCT" -gt 20 ] silently errored on non-integer values (suppressed by 2>/dev/null), which would have been a false negative above 20%.

Scope

Path + parse fixes only — minimal blast radius. Action-version upgrades (checkout@v5, setup-bun@v2, upload-sarif@v4, etc.) are intentionally excluded (deferred to a later Phase 5 PR).

Verification

• git grep "main/\|working-directory: main" -- .github/workflows/code-quality.yml → no matches.
• Code Quality Analysis workflow run 28145695207 via workflow_dispatch on this branch → success.
• Thresholds step output: Duplication: 2.20%, All quality thresholds passed.
• Pre-commit hooks: detect-secrets, yaml-check, all passed.

Part of the CI triage effort (2026-06-24), Phase 1.