feat(ariadne): enable the SonarQube sweep, scoped to one project

Static analysis findings never fail a build, so nothing has ever pulled them
into triage. There are 139 open on Ariadne alone, each already naming its
file, line and rule - better-located evidence than the console text the
code-repair flow usually mines.

Scoped deliberately narrow to start: one project, one proposal per hourly
sweep, and only findings SonarQube itself estimates at 20 minutes or less.
Effort is the filter rather than severity because it is the closest proxy for
the single anchored change the patch validator can actually check. The
64-open-proposal ceiling still applies on top, so the queue cannot grow while
nobody is draining it.

Hotspots are not in the type list and cannot be: SonarQube models them as
needing human review, this instance's quality gate fails on exactly that
condition, and an automation that resolved them would be marking them reviewed
without review.

The token comes from Vault. Ariadne's maintenance role was granted read on
kv/data/atlas/quality/sonarqube-oidc, which it did not previously have.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/maintenance/apps/ariadne-deployment.yaml

@@ -35,6 +35,9 @@ spec:
           export GAME_MODE_HOOK_TOKEN="{{ .Data.data.game_mode_hook_token }}"
           {{- end }}
           {{ end }}
+          {{ with secret "kv/data/atlas/quality/sonarqube-oidc" }}
+          export ARIADNE_HERMES_SONAR_TOKEN="{{ .Data.data.sonarqube_exporter_token }}"
+          {{ end }}
           {{ with secret "kv/data/atlas/portal/atlas-portal-db" }}
           export PORTAL_DATABASE_URL="{{ .Data.data.PORTAL_DATABASE_URL }}"
           {{ end }}
@@ -541,9 +544,39 @@ spec:
             # executes on its own authority, whereas everything here becomes a
             # pull request a person reads before anything changes.
             - name: ARIADNE_HERMES_FIX_CATEGORIES
-              value: lint_violation,undefined_name,failing_assertion
+              value: sonarqube_issue,lint_violation,undefined_name,failing_assertion
             - name: ARIADNE_HERMES_CODE_MAX_OPEN_PROPOSALS
               value: "64"
+            # The SonarQube sweep: the second way into the proposal flow. Triage
+            # enters on a build failure; static analysis never fails anything, so
+            # its findings would otherwise sit unread forever. From evidence
+            # collection onward the path is identical, gates included.
+            - name: ARIADNE_HERMES_SONAR_ENABLED
+              value: "true"
+            - name: ARIADNE_HERMES_SONAR_URL
+              value: http://sonarqube.quality.svc.cluster.local:9000
+            # sonar-project=jenkins-job. The job already carries the repository
+            # mapping in ARIADNE_HERMES_CODE_REPOS, so there is no second place
+            # for the two to disagree. Scoped to one project to start: this opens
+            # pull requests nobody asked for, and that is worth widening
+            # deliberately rather than by default.
+            - name: ARIADNE_HERMES_SONAR_PROJECTS
+              value: ariadne=ariadne
+            # Hotspots are absent by construction - they need human review, not a
+            # patch - so only findings with a code fix are ever requested.
+            - name: ARIADNE_HERMES_SONAR_TYPES
+              value: CODE_SMELL,BUG
+            # One per sweep, hourly. A backlog of 139 findings turned into 139
+            # pull requests would make the review gate theatre; the open-proposal
+            # ceiling above still applies on top of this.
+            - name: ARIADNE_HERMES_SONAR_MAX_PER_SWEEP
+              value: "1"
+            # SonarQube's own effort estimate is the filter, not severity: it is
+            # the closest proxy for the single anchored change the patch
+            # validator can check. Anything it calls longer than this is a
+            # refactor for a person.
+            - name: ARIADNE_HERMES_SONAR_MAX_EFFORT_MINUTES
+              value: "20"
             - name: ARIADNE_HERMES_CODE_REPOS
               value: metis=bstein/metis,lesavka=bstein/lesavka,soteria=bstein/soteria,bstein-dev-home=bstein/bstein-dev-home,ariadne=bstein/ariadne,ananke=bstein/ananke,pegasus=bstein/pegasus,atlasbot=bstein/atlasbot
             - name: ARIADNE_HERMES_CODE_BASE_BRANCHES