#### Initial Release — TLCTC SonarQube v1.0.0

##### New Pack: TLCTC SonarQube

- Operationalises the TLCTC v2.1 taxonomy for SonarQube SAST pipelines (self-hosted SonarQube and SonarCloud).
- Python 3.11+ CLI `tlctc-sonar` with four subcommands: `classify`, `tag`, `validate`, `version`. Stdlib only (`urllib`, `argparse`, `tomllib`, `fnmatch`); no third-party dependencies.
- Pulls issues via `/api/issues/search`, joins them against the canonical `mappings/mitre-cwe/tlctc-cwe.json` (985 reviewed CWE entries), and classifies findings by TLCTC cluster with full provenance (cluster, CWE, verdict, role-resolution trace).
- R-ROLE context-aware logic: file-path globs resolve `#2 | #3` (and `#2 -> #7 | #3 -> #7`) ambiguities by inspecting `issue.component` against configurable server / client glob lists.
- Verdict-aware: `Allowed` and `Allowed-with-Review` classify and tag; `Discouraged` lands in a Markdown low-confidence section; `Prohibited` is silently skipped (logged at `--verbose`).
- Path-notation handling: single `#N`, sequences `#2 -> #7`, and alternations are all parsed into a typed AST. Sequences tag both clusters; primary cluster is the first step (Axiom VI).
- Three report formats: JSON cluster summary + per-issue array, Markdown PR-comment body, SARIF 2.1.0 with TLCTC properties bag (one rule per cluster).
- Read-only by default; `--apply-tags` opt-in flag writes back to SonarQube via `/api/issues/set_tags` using a normalized form (`tlctc-01` ... `tlctc-10`, lowercase, no `#`).
- CI gate: `--fail-on-cluster #N[,#N]` exits non-zero when findings land in specified clusters. `--strict-verdict` excludes `Allowed-with-Review` from gating.
- Declarative zero-Python starter (`declarative/`): tag import CSV, quality profile XML raising severity on R-EXEC / R-CRED CWEs, portfolio dashboard JSON.
- Test cases (`test-cases.md`) covering R-ROLE, R-EXEC, R-CRED, R-SUPPLY, Axiom VI, Axiom III verdict filter; runnable offline against canned fixtures.
