"Build" (SonarCloud) fails 403 — needs owner token/plan fix

[hyperpolymath]

"Build" check (SonarCloud scan) fails with HTTP 403 — needs owner action

build.yml's SonarCloud scan fails on main with HTTP 403 Forbidden — the SONAR_TOKEN is rejected at api.sonarcloud.io. Confirmed from run log 29595912600 (... 403 ... EXECUTION FAILURE). The SONAR_TOKEN secret exists (set 2026-06-25) but is being rejected, so the cause is SonarCloud-side, not fixable from repo code:

• token revoked / expired → regenerate in SonarCloud and update the SONAR_TOKEN secret, or
• org plan lapsed, or
• the SonarCloud project has Automatic Analysis enabled (which rejects CI-submitted analysis) → disable it for CI scanning.

Possibly-related lead: closed PR #87 attempted "pin sonarqube-scan-action back to v8.1.0 (v8.2.0 JRE 403)" — suggesting part of the 403 may be a v8.2.0 action regression fetching the JRE, independent of the token. Worth checking the action version alongside the token.

Owner decision (2026-07-17): keep SonarCloud; owner fixes the credential/config side. No repo-side bodge per shared-CI-fate policy. Estate-wide Sonar status is heterogeneous (not one systemic 403) — this repo + cicd-squabbler are the two log-confirmed 403s.