Align maintenance Sonar routing with the selected quality contract #342

The maintenance Sonar workflow is configured to scan 3.9.x even though its actual provider branch request fails, and green maintenance PR results use the main analysis baseline. This is a tooling/routing gap, not an accepted maintenance quality finding.

Evidence:

• Actual maintenance source9f1487e9 scan 42291035907 failed with the provider non-main-branch restriction; the branch gate API returned403.
• PR335 scope correction and PR339 terminal record retain the exact head/base/target distinction: provider base main despite target3.9.x. Their observed green results are not maintenance baseline analysis.
• The operator-panel decision selects green CI plus Security Source review as maintenance quality evidence. Sonar3.9.x is not required and does not block Backport activity grant transit correction to 3.9.x #339 or release3.9.5. Historical NONPASS/403 and wrong-base observations remain true; no false Sonar PASS is inferred.

Next action / owners: sdk-php owns a small workflow/routing and documented-quality correction consistent with that decision; General owns any necessary organization/account capability decision under central187. Choose a supported branch-analysis route or an explicit honest not-required/skip scope for maintenance, retaining all ordinary CI and finite Security Source requirements. Source release work remains higher priority.

Acceptance:

• Future maintenance checks follow the selected CI + Security quality contract and do not present an unsupported branch request or main-baseline PR result as required maintenance quality.
• Main Sonar checks, profiles/rules/thresholds, ordinary source checks and existing release/docs gates remain intact.
• If maintenance analysis is later selected, verify its actual immutable head and analysis baseline/target. If not selected, report that scope clearly rather than a fabricated PASS.
• No project/main-label/provider reroute, private-project change, credentials, subscription purchase or other account effect follows from this issue; any such action needs its own applicable authorization.
• Link the final source change/checks and preserve the historical scan evidence.

This follow-up is explicitly non-blocking for3.9.5 and separate from #340's actual caller/effect admission and #327's installed producer/consumer evidence. No account, plan, gate configuration or workflow execution is changed by filing it.