fix: use sonar-scanner-cli container instead of npx for sonar scan

npx sonar-scanner fails on node:18-slim — no Java. Switch to dedicated
sonarsource/sonar-scanner-cli container with Java + scanner bundled.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

vars/homelabK8sAgent.groovy

@@ -5,11 +5,13 @@
  *   nodeImage       - default: node:18-slim
  *   harborRegistry  - default: harbor-core.harbor.svc.cluster.local
  *   withTools       - include alpine/git container, default: false
+ *   withSonar       - include sonarsource/sonar-scanner-cli container, default: false
  */
 def call(Map config = [:]) {
     def nodeImage  = config.nodeImage      ?: 'node:18-slim'
     def harborReg  = config.harborRegistry ?: 'harbor-core.harbor.svc.cluster.local'
     def withTools  = config.withTools      ?: false
+    def withSonar  = config.withSonar      ?: false
 
     def toolsBlock = withTools ? """
   - name: tools
@@ -19,6 +21,14 @@ def call(Map config = [:]) {
     args:
     - infinity""" : ""
 
+    def sonarBlock = withSonar ? """
+  - name: sonar
+    image: sonarsource/sonar-scanner-cli:latest
+    command:
+    - sleep
+    args:
+    - infinity""" : ""
+
     return """
 apiVersion: v1
 kind: Pod
@@ -38,6 +48,6 @@ spec:
     - name: DOCKER_TLS_CERTDIR
       value: ""
     args:
-    - --insecure-registry=${harborReg}${toolsBlock}
+    - --insecure-registry=${harborReg}${toolsBlock}${sonarBlock}
 """.stripIndent()
 }