ci(sonar): stop a runner backlog from failing an unrelated PR

[phsb5321]

Closes #319.

The failure

SonarQube standalone scan is a required check. When its 10-minute job timeout fires mid-coverage, the PR goes red for a reason that has nothing to do with the diff under review, and the only remedy is a manual re-run once the runner queue drains.

Observed 2026-08-01 — a 13-run backlog hit the two self-hosted runners:

run	outcome	why
02:21	cancelled	job ran 02:23:00 → 02:33:23, killed mid Generate Go coverage report
02:12	cancelled	superseded sha, cancelled by hand — not a timeout
01:54	cancelled	main, same shape
01:37 and back to 07-28	success	—

Nothing about the code changed across that boundary. 10m23s is the whole story.

The fix

All three candidates from the issue, because they address different halves of the problem.

1. concurrency group per ref. sonar.yml had no concurrency: block at all, so a superseded push left its scan running and competing for a runner with the scan that replaced it. cancel-in-progress is ${{ github.event_name == 'pull_request' }} rather than a flat true: a push to main is not superseded in the same sense, and cancelling it would silently drop the baseline scan that PR scans are compared against.

2. Drop -race from the coverage run. Test (go test -race) (ci.yml:144, also a required check) already gates races on every PR. Running the detector a second time buys no coverage signal and roughly doubles this step's wall time on a contended runner. -covermode=atomic stays — it does not require -race.

3. timeout-minutes: 10 → 20. Headroom for a genuinely contended run, now that (1) and (2) have removed most of the contention. The step still cannot hang indefinitely on a real failure: the || true on the coverage command swallows non-zero exits, not wall time.

Verification

• actionlint — clean.
• zizmor --persona=auditor .github/workflows/sonar.yml — No findings to report. Good job! (2 ignored).
• Required-check names confirmed against the live ruleset (gh api repos/yolo-labz/wa/rulesets): both SonarQube standalone scan and Test (go test -race) are required, which is what makes (2) safe and (1) worth doing.

The real proof is this PR's own scan finishing inside the new budget — and that only exercises the uncontended path. The contended path cannot be reproduced on demand; if a backlog recurs and the job still times out at 20 minutes, the next step is splitting coverage out of the scan job rather than raising the number again.

Escalation

[pending] Pedro — this edits a file under .github/workflows/, which is escalate-class per CLAUDE.md rule 33. Not self-merging.

Revert path: git revert a10578f.

[phsb5321]

Rebased onto ef97bb2 (current main) — merge-ready, all checks green.

[pending] Pedro — edits .github/workflows/, which is escalate-class. Not self-merging. Revert path once landed: git revert <squash-sha>.