Add a local SonarCloud reproduction

[matt-edmondson]

Problem

CI analyses this repository with the SonarCloud scanner, which injects the Sonar analyzers into the compilation. A plain dotnet build does not run them, so Sonar findings are invisible locally and only surface after a push.

This bit #87 concretely: the quality gate passed but reported three new issues, and the bot comment links only to a dashboard. Without local reproduction there was no way to see what they were.

It works, and the config already exists next door

ktsu.Semantics solves this with a .sonarlint/ directory that is not imported by anything and is pointed at explicitly. The same approach works here — verified while fixing #87's findings, which named all three (two S3267, one S3878) and let them be fixed before the next push.

One difference from the Semantics setup. Its CLAUDE.md records:

CustomBeforeMicrosoftCommonProps does not reach [<Sdk Name="..." />] projects

Every project here uses that element form, so the invocation has to be CustomAfterMicrosoftCommonProps, which does reach them:

dotnet build -p:CustomAfterMicrosoftCommonProps=$PWD/.sonarlint/sonar-local.props

Suggested change

Add .sonarlint/sonar-local.props:

<Project>
  <ItemGroup>
    <PackageReference Include="SonarAnalyzer.CSharp" VersionOverride="10.18.0.131500" PrivateAssets="all" />
    <EditorConfigFiles Include="$(MSBuildThisFileDirectory)sonar-local.globalconfig" />
  </ItemGroup>
</Project>

…plus a sonar-local.globalconfig raising the rules CI reports that the package ships disabled, and silencing any the package enables that CI's profile does not report. Then document the invocation in README.md or a CLAUDE.md.

Derive the globalconfig from this repository's own quality profile. Borrowing Semantics' verbatim gets close but not exact — it silences S1481, and this repository's profile may differ. Calibrate by running locally and comparing against a dashboard read.

Nothing should import the file automatically, so normal builds, CI and packaging stay unaffected.

A known gap this would close

#87 fixed three Sonar findings but left one new issue that could not be identified, because the local reproduction was borrowed from Semantics and reports nothing outside files identical to main. A properly calibrated config here would name it.

Acceptance criteria

• A documented local command runs the Sonar analyzers over every project.
• Its output matches what SonarCloud reports for the same commit — including the outstanding issue from Generalize CodeBlocker into a code-generation substrate #87.
• Nothing imports the config automatically.

Context

Found while working ktsu-dev/Semantics#181.