fix(ci): add statuses: write permission to restore SonarCloud PR decoration (#4574)

The explicit permissions block added in #4571 inadvertently dropped the
repo default statuses: write permission. SonarCloud's GitHub App requires
this to post quality gate commit statuses back to PRs.

Before #4571, no permissions block meant the job inherited the repo
default which included statuses: write - this is why decoration was
working on Apr 14 but stopped after #4571 merged.

Author: devinea

.github/workflows/sonar.yml

@@ -12,6 +12,7 @@ jobs:
     permissions:
       actions: read # Required to download artifacts
       pull-requests: write # Required for PR decoration comments
+      statuses: write # Required for SonarCloud to post quality gate commit status
     steps:
       - name: 'Checkout project'
         uses: actions/checkout@v6