ci(sonarcloud): make SonarCloud scan conditional on SONAR_TOKEN

[twicechild]

Summary

• Makes the SonarCloud scan step optional by guarding it with env.SONAR_TOKEN != ''
• Hoists SONAR_TOKEN from step-level to job-level env so it can be tested in if: conditions (GitHub Actions does not allow secrets.* in if: expressions)
• When the secret is not configured (e.g. in forks), the step is cleanly skipped instead of failing

This follows the same pattern used in entity-resolution-spec.

[gkostkowski]

Looks good, thanks.