npx sonar-scanner fails on node:18-slim — no Java. Switch to dedicated
sonarsource/sonar-scanner-cli container with Java + scanner bundled.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
values.yaml image.tag defaults to 'latest' for initial deploy.
Pipeline always pushes both <branch>-<random8> and :latest so
ArgoCD can pull the newest image without a chart version bump.
