Finish reliability showcase quality gates

[krotname]

What changed

• make Codecov uploads use OIDC and fail CI on upload errors
• add CI-based SonarCloud analysis with JaCoCo coverage and quality-gate enforcement
• resolve the public Sonar, CodeQL, and SpotBugs findings in code
• add property-based transaction validation invariants
• update JUnit, SpotBugs, setup-java, and CodeQL actions
• align the README showcase table and quality badges with the implemented checks

Why

The repository rebrand was complete, but Codecov reported unknown coverage, SonarCloud was red and still used the old project key, OpenSSF metadata was stale, and the transaction component did not yet substantiate its property-based testing story.

Verification

• mvn -B test -Dgroups='property' --file pom.xml
• mvn -B -DskipTests checkstyle:check pmd:check spotbugs:check --file pom.xml
• mvn -B verify --file pom.xml — 597 tests, all coverage and static-analysis gates passed
• all workflow YAML files parse successfully

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud