ci: arm the code-quality gate (soft-fail off) + all-files dispatch

[LukasWodka]

The #1303 flip: soft-fail: false — from this merge on, ruff/shellcheck/gitleaks/house-rules findings fail the check (which is already marked required on develop). This repo's backlog is at zero, so only new findings can ever block. Also adds workflow_dispatch(all-files) for whole-tree scans (the gitleaks baseline run follows the merge).

This PR is its own proof-run: the armed configuration must pass on this very diff.

Part of tracebloc/backend#1303

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes CI enforcement only, but merges can now be blocked by new lint/security findings on a required check.

Overview
Arms the required code-quality check by passing soft-fail: false into the shared code-quality.yml workflow, so ruff, shellcheck, gitleaks, and house-rules findings fail the job instead of advisory-only behavior (backend#1303).

Adds workflow_dispatch with an all-files boolean (default true) so maintainers can trigger a full-repo scan rather than a PR diff, and forwards all-files: ${{ inputs.all-files || false }} on normal PR runs (false when the input is absent).

^{Reviewed by Cursor Bugbot for commit 31fe64c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 42 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• .github#106 — fix(fr-pass): never no-op in silence — job if swallowed self-signoffs, reaction was 403ing · author: @LukasWodka · no reviewer assigned
• .github#107 — feat(ci): weekly merge-settings drift guard · author: @LukasWodka · no reviewer assigned
• averaging-service#222 — fix(sklearn): unwrap Pipeline to terminal estimator before merge dispatch (Prod: Set kubeconfig context namespace after Helm install for tracebloc  #209) · author: @divyasinghds · no reviewer assigned
• averaging-service#225 — fix(averaging): fail fast + dead-letter on permission-denied weight write (release: promote develop → main (installer hardening — OOM gate, apt/needrestart fixes, drift CI) #221) · author: @divyasinghds · no reviewer assigned
• averaging-service#236 — feat(blob_store): vendor the blob_store seam + settings (#1162) · author: @saadqbal · no reviewer assigned
• averaging-service#237 — feat(blob_store): read sklearn edge weights through blob_store (#1162) · author: @saadqbal · no reviewer assigned
• averaging-service#241 — feat(blob_store): read prior-global + array edge weights via blob_store (#1162) · author: @saadqbal · no reviewer assigned
• averaging-service#244 — ci: arm the code-quality gate (soft-fail off) + all-files dispatch · author: @LukasWodka · no reviewer assigned
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)