Stability checkpoint — UI CI debt closed (sonarcloud + e2e tour-seen)

Pipeline #471 green on main commit 240fba1.

Closes the 4-shield UI CI debt session :
- grype:scan ✅ closed (!120, 2026-04-24)
- dockle ✅ closed (!121, 2026-04-24)
- sonarcloud 🟢 scoped-out via 'when: manual' + ADR-0011 (JS bridge crash root cause)
  Custom sonar-scanner Docker image at build/sonar-scanner.Dockerfile pinned
  to sonarsource/sonar-scanner-cli:11.5.0.2154 + multi-platform amd64+arm64.
- e2e:kind 🔴 SHIELD with refreshed dated TODO 2026-05-25 (30d) +
  3-step plan inline in .gitlab-ci/test.yml line 82.

Plus : e2e seed tour-seen localStorage to skip onboarding overlay (parallel
session fix to e2e:kind spec timing).

See:
- docs/audit/ui-ci-debt-status.md (closure report)
- ADR-0011 (sonarcloud JS bridge flaky)