* ci: preserve every main-branch Sonar scan
* ci: never cancel a running main Sonar scan, as the app repos do
Per-run concurrency groups let main scans run side by side, so an older
commit's analysis can reach SonarCloud after a newer one. Keep one group
per ref and only stop cancelling on main, matching every app repo's
sonarcloud.yml.