fix: resolve SonarQube compilation database path mismatch caused by Nix store paths

[Copilot]

The Nix build sandboxes sources under /nix/store/<hash>-source/, so compile_commands.json contains absolute paths into the store rather than the workspace. SonarQube finds the 8 compilation units in the database but matches 0 files against sonar.sources, causing the scan to fail.

Changes

• .github/workflows/ci-linux.yml — Adds a "Fix compile_commands.json paths" step between the Nix build and the SonarQube scan:

  • Copies result/compile_commands.json (read-only in the Nix store) into the workspace
  • Detects the /nix/store/<hash> prefix dynamically from the first database entry and replaces it with $PWD

• sonar-project.properties — Points sonar.cfamily.compile-commands to the patched workspace-local copy instead of result/compile_commands.json

# Dynamically detects and replaces any Nix store prefix
match = re.match(r'^(/nix/store/[^/]+)', file_path)
if nix_prefix:
    content = content.replace(nix_prefix, workspace)