SonarQube CI on GitHub Actions

Analysis re-scans the whole codebase on every pull request.

Why it happens

The SonarQube analysis cache is not persisted and shallow clones break blame attribution.

What to change

1. Cache ~/.sonar/cache keyed on the scanner version
2. Fetch full git history so blame data is accurate
3. Run analysis only on the changed files for pull-request scans

SonarQube on runnerhut

jobs:
  scan:
    runs-on: runnerhut-8vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: SonarSource/sonarqube-scan-action@v4

The only runnerhut-specific line is `runs-on: runnerhut-8vcpu-ubuntu-2404`. Everything else is standard GitHub Actions — the same actions, the same secrets and the same permissions model you use today.