feat: implement issue #614 — SonarCloud: miscellaneous findings
DO
3h ago+223+223+012345678901234567890123456789-0-0-0123456789
Problem
SonarCloud: miscellaneous findings
From the issue: 6 open SonarCloud finding(s) in combsmith/broodly, worst severity BLOCKER. Generated by the org SonarCloud Audit.
Risk
Low — changes automation shell logic under scripts/, covered by shellcheck (--severity=warning) and the bats suite.
Test plan
Tests added/updated: tests/scripts/sonar-infra-hardening.test.sh. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the bats suite runs in CI.
Rollback
Revert this PR. No non-revertible side effects (no tags, migrations, or external state).
Monitoring
This PR's Lint (shellcheck) and bats checks show pass/fail; watch subsequent dev-lead / pr-review runs for behavioral regressions.
Closes #614