feat: add .sonarcloud.properties with explicit src-only inclusion

Create .sonarcloud.properties file which takes precedence over
sonar-project.properties for SonarCloud scans. Use whitelist approach
to ONLY scan src/ directory.

**Key Strategy Change:**

Instead of trying to exclude test files (blacklist), explicitly
include ONLY src files (whitelist):

```properties
sonar.sources=src
sonar.inclusions=src/**/*.ts
```

This tells SonarCloud to ONLY scan TypeScript files in src/ directory,
completely ignoring everything else including tests/.

**Additional Safeguards:**

1. **Issue ignore rules (e1-e7)**
   - e1-e3: Ignore ALL rules in tests/**, *.test.ts, *.spec.ts
   - e4-e5: Specifically target typescript:S4036 and S* rules
   - e6-e7: Explicitly ignore problem files by name

2. **Multiple exclusion layers**
   - sonar.exclusions
   - sonar.coverage.exclusions
   - sonar.cpd.exclusions
   - sonar.security.exclusions
   - sonar.global.exclusions

**Why .sonarcloud.properties:**
- SonarCloud specifically looks for this file first
- Takes precedence over sonar-project.properties
- More reliable for cloud-specific configuration

**Expected Result:**
- SonarCloud should ONLY analyze src/**/*.ts files
- All test files completely excluded from scanning
- No more S4036 PATH security warnings from test files

Author: claude

.sonarcloud.properties

@@ -0,0 +1,53 @@
+# SonarCloud Configuration - Test Exclusion
+# This file takes precedence over sonar-project.properties for SonarCloud
+
+# ONLY scan src directory
+sonar.sources=src
+
+# Explicitly include ONLY TypeScript files in src
+sonar.inclusions=src/**/*.ts
+
+# ABSOLUTELY EXCLUDE test files - multiple exclusion strategies
+sonar.exclusions=tests/**,tests/**/*,tests/**/*.ts,tests/**/**,**/*.test.ts,**/*.spec.ts,**/test-*.ts,**/helpers/test-utils.ts,dist/**,coverage/**,node_modules/**,examples/**,scripts/**,**/*.d.ts
+
+# Exclude from coverage
+sonar.coverage.exclusions=tests/**,**/*.test.ts,**/*.spec.ts
+
+# Exclude from duplication
+sonar.cpd.exclusions=tests/**,**/*.test.ts,**/*.spec.ts
+
+# Exclude from security analysis
+sonar.security.exclusions=tests/**,**/*.test.ts,**/*.spec.ts
+
+# Global exclusions
+sonar.global.exclusions=tests/**
+
+# Issue ignore rules - suppress ALL issues in test files
+sonar.issue.ignore.multicriteria=e1,e2,e3,e4,e5,e6,e7
+
+# Ignore ALL rules for tests/** directory
+sonar.issue.ignore.multicriteria.e1.ruleKey=*
+sonar.issue.ignore.multicriteria.e1.resourceKey=tests/**
+
+# Ignore ALL rules for **/*.test.ts
+sonar.issue.ignore.multicriteria.e2.ruleKey=*
+sonar.issue.ignore.multicriteria.e2.resourceKey=**/*.test.ts
+
+# Ignore ALL rules for **/*.spec.ts
+sonar.issue.ignore.multicriteria.e3.ruleKey=*
+sonar.issue.ignore.multicriteria.e3.resourceKey=**/*.spec.ts
+
+# Ignore typescript:S4036 (PATH security) in tests
+sonar.issue.ignore.multicriteria.e4.ruleKey=typescript:S4036
+sonar.issue.ignore.multicriteria.e4.resourceKey=tests/**
+
+# Ignore all TypeScript security rules in tests
+sonar.issue.ignore.multicriteria.e5.ruleKey=typescript:S*
+sonar.issue.ignore.multicriteria.e5.resourceKey=tests/**
+
+# Ignore all rules in specific problem files
+sonar.issue.ignore.multicriteria.e6.ruleKey=*
+sonar.issue.ignore.multicriteria.e6.resourceKey=tests/production-validation.test.ts
+
+sonar.issue.ignore.multicriteria.e7.ruleKey=*
+sonar.issue.ignore.multicriteria.e7.resourceKey=tests/cli-production-mode.test.ts