[Epic] Clear the SonarCloud quality gate (all open issues)

[skearnes]

Get the SonarCloud quality gate green on main and keep it green, addressing all open SonarCloud issues — including pre-existing ones from before the triage plan (#656 §10).

Process rule: SonarCloud Code Analysis is part of CI; a PR isn't green unless its Sonar gate passes. Each cleanup PR must introduce no new issues.

Current state (2026-05-30): main gate ERROR on new_reliability_rating=3 and new_security_hotspots_reviewed=42.9%; ~166 total open issues.

Batches (one or more PRs each)

• Bugs / reliability (4) — main.py:52 discarded asyncio.create_task (keep a reference); 3× synchronous open() inside async def tests. Highest priority (drives new_reliability_rating).
• Hotspots — Actions SHA pinning — done in Pin GitHub Actions to commit SHAs (SonarCloud hotspot) #670.
• Hotspots — ui/index.html resource integrity (gtag + Google Fonts). External CDN resources; SRI is impractical → needs a maintainer "reviewed / safe" decision in the SonarCloud dashboard (cannot be code-fixed by an agent).
• Code smells (~158) — mechanical, batched by rule: globalThis over window; Number.parseInt/parseFloat; array .includes() → Set.has(); node:buffer; unnecessary type assertions; negated conditions; unused vars → _; empty objects; TypeError over Error; outstanding TODOs.

See #656 §10.

🤖 Generated with Claude Code

[skearnes]

Status update:

• ✅ Batch 1 (reliability bugs) merged (Fix SonarCloud reliability bugs (task GC + async file I/O) #672) — new_reliability_rating is back to A.
• ✅ Hotspots — Actions SHA pinning merged (Pin GitHub Actions to commit SHAs (SonarCloud hotspot) #670).
• ⛔ Gate's only remaining blocker: new_security_hotspots_reviewed — the ui/index.html resource-integrity hotspots (gtag + Google Fonts <script>/<link>). These are external CDN resources where SRI isn't practical, so they need a maintainer "reviewed / safe" decision in the SonarCloud dashboard (or a quality-gate config change). This is the one item an agent can't resolve — flagging for a human.
• ▶️ Batch 3 (code smells, ~158) now in progress, batched by rule (these don't block the gate but are tracked here).

Analysis performed with Claude Code (Claude Opus 4.8).