…r branch

SonarCloud rejects a branch analysis dated older than the branch's
latest processed one. All merge-queue entries analyze the target branch,
so when entry N's report uploaded after entry N+1's, SonarCloud rejected
it and flipped the commit's SonarCloud check to cancelled ("Date of
analysis cannot be older than the date of the last known analysis").
Seen on 5027d25, where the scans of three stacked queue entries
(#21648, #21584, #21640) raced and #21648's analysis lost.

Restructure so branch analyses can never be submitted out of order:

- merge_group runs keep `make test-sonar-coverage` as a gate check but
  no longer scan; they upload coverage-test-all.out as a short-retention
  artifact instead.
- A new push-triggered SonarCloud Branch Scan workflow (main and
  release/**, matching the branches SonarCloud tracks) downloads that
  artifact — the merge queue fast-forwards the target branch to the
  already-tested merge commit, so the pushed SHA equals the merge-queue
  run's head SHA and the artifact maps to the commit exactly — and runs
  only the scanner (~7 min instead of ~25). If no artifact exists
  (direct push, expired retention), it falls back to running the tests.
- Scans are serialized per branch FIFO via `concurrency.queue: max`
  (GitHub Actions, 2026-05), so every merged commit is analyzed, in
  order, with no runs cancelled in merge bursts.
- PR scans (Sonar PR analyses, no main-branch date ordering) and
  cache-warming runs are unchanged.

actionlint (≤ v1.7.12) does not know the `queue` key yet, so lint.yml
gains a narrow --ignore alongside the existing workspace one.

A failed analysis upload also no longer involves the gate: scanner
failures now surface on a post-merge run instead, while PR runs keep
exercising the scanner so breakage is still caught before merge.

…r branch (erigontech#21669)

## Problem

SonarCloud rejects a branch analysis dated older than the branch's
latest processed one. Every merge-queue entry analyzes the target
branch, so when queue entry N's report uploads *after* entry N+1's,
SonarCloud rejects N's with *"Date of analysis cannot be older than the
date of the last known analysis"* and flips that commit's **SonarCloud
Code Analysis** check to `cancelled`.

Seen on
[`5027d259c2`](erigontech@5027d25):
three stacked queue entries (erigontech#21648, erigontech#21584, erigontech#21640) scanned
concurrently; erigontech#21584 started 6s later but uploaded 21s earlier, so
erigontech#21648's analysis was rejected as out of order. No impact on the gate
(the scan step is `continue-on-error` and the merge succeeded), but it
leaves a spurious failed check on a merged commit.

## Fix

Make it structurally impossible to submit branch analyses out of order:

- **`merge_group` runs** keep `make test-sonar-coverage` as a gate check
but **no longer scan**. They upload `coverage-test-all.out` as a 7-day
artifact.
- **A new `SonarCloud Branch Scan` workflow** (`push` on `main` +
`release/**`, matching the branches SonarCloud tracks) downloads that
artifact and runs **only the scanner** (~7 min vs ~25). The merge queue
fast-forwards the target branch to the already-tested merge commit, so
the pushed SHA equals the merge-queue run's head SHA and the artifact
maps to the commit exactly. If no artifact exists (direct push, or
expired retention), it falls back to running the tests itself.
- Branch scans are serialized per branch **FIFO** via
`concurrency.queue: max` ([GitHub Actions,
2026-05](https://github.blog/changelog/2026-05-07-github-actions-concurrency-groups-now-allow-larger-queues/)),
so every merged commit is analyzed, in order, with **no runs cancelled**
during merge bursts.
- **PR scans** (Sonar PR analyses — separate from main-branch date
ordering) and **cache-warming** runs are unchanged.

A failed analysis upload no longer touches the gate at all: scanner
failures now surface on a post-merge run, while PR runs keep exercising
the scanner so config/scanner breakage is still caught before merge.

## Notes

- `actionlint` (≤ v1.7.12, the latest release) does not know the `queue`
concurrency key yet, so `lint.yml` gets a narrow `--ignore` alongside
the existing `workspace` one. Removable once actionlint learns the key.
- `concurrency.queue: max` is ~1 month old — first real merge-burst
after this lands is where FIFO ordering gets exercised live.

## Testing

- `make lint`, `actionlint` (CI flags), and `zizmor` (repo config) all
clean; the new workflow is finding-free.
- The artifact-lookup script was shellchecked and run against live API
data: correctly resolves the merge-queue run by head SHA, filters
expired artifacts, and degrades to the test-running fallback on a
missing artifact or total API failure (never fails the job).