#994 fix: restore SonarCloud Quality Gate on main

Summary

Restores SonarCloud Quality Gate conditions that failed on main after #992 merge (d04393f).

Quality Gate conditions cleared

Condition	Fix
new_reliability_rating (6 BUGs)	localeCompare compare fns in generate-message-contexts.ts; switch dispatch in visual-diff.mjs (S2871 / S3403)
new_security_rating (23 VULNERABILITIES)	--ignore-scripts on CI bun install; pin wrangler@4.126.0; payload path validation in blog importers; safe numeric logging in fetch scripts
Security Hotspots TO_REVIEW (5)	Full commit SHAs in typos.yml / update-org-readme.yml; secrets via env block; fixed binary paths in generate-social-images.ts
new_duplicated_lines_density (3.2% > 3%)	Remove unused duplicate scripts/action.mjs; storyImage / storyImages helpers in appStoreRefusalStories.ts

Changes by area

BUGs

• scripts/generate-message-contexts.ts: sort with (a, b) => a.localeCompare(b)
• scripts/visual-diff.mjs: switch on command + CAPTURE_LABELS.has() for labels

Workflow security (S6505 / S8543 / S7637 / S7636)

• Add --ignore-scripts to bun install --frozen-lockfile in deploy/import/test workflows
• Pin bunx wrangler@4.126.0 in distrib/outrank worker deploy steps
• update-org-readme.yml: frozen lockfile + ignore-scripts, pinned action SHAs, PAT via env
• typos.yml: pinned action SHAs (including crate-ci/typos@631208b7…)

Script security (S8707 / S5145 / S4036)

• import_distrib.ts / import_outrank.ts: resolve + workspace containment before reading CLI payload paths
• Fetch scripts: log numbers via Number() / validated ISO timestamps / error counts only
• generate-social-images.ts: resolve rsvg-convert / magick from fixed system paths (no shell PATH lookup)

Duplication

• Delete unused scripts/action.mjs (282 duplicated lines, no imports)
• appStoreRefusalStories.ts: shared storyImage / storyImages helpers

Test plan

• CI workflows unchanged except security hardening flags
• SonarCloud Code Analysis passes on this PR
• GitHub Actions test workflow green

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Bug Fixes

  • Improved validation for imported content, including clearer missing-file handling and workspace boundary checks.
  • Improved reliability of statistics, timestamp, and download-count reporting.
  • Standardized refusal-story image handling for more consistent display.

• Chores

  • Hardened automated deployments by disabling install scripts and pinning key tooling versions.
  • Strengthened workflow action security through immutable version references.
  • Improved compatibility when generating social images and visual comparisons.
  • Removed obsolete action catalog data.