chore(ci-governance): synchronize Node profile

[inditextechci-sync]

CI governance synchronization

This PR was generated by the PR-only controller. Review and merge it; the controller never pushes directly to the default branch.

Profile

• node (Node)

Source revisions

• base: 1af484ce27180513e8cb4ca8905163fdea7c77cb
• node: 77100ef76f298940496e804f5ed424c6ad504332

Planned changes

• update .github/inditextech-ci-sync-manifest.json
• update .github/workflows/code-npm_node-PR_verify.yml
• update .github/workflows/code-npm_node-publish-release-and-snapshot.yml
• update .github/workflows/code-npm_node-release-core.yml
• update .github/workflows/code-npm_node-sonarcloud-analysis.yml
• update .github/workflows/code-release_preview.yml
• update .github/workflows/codeql.yml
• update .github/workflows/pr-verify.yml
• update .github/workflows/push-verify.yml
• add .github/workflows/scorecard-analysis.yml
• update .github/workflows/sync-to-develop.yml

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[ivanasabi]

Closing without merge to clear the bounded provenance inspection window for the Node SYNC lane.

The bot's automated/ci-governance-sync branch had accumulated 101 dispatch commits (ahead_by=101) without this PR being merged, tripping the planner's ahead_by > 100 limit. The PR was technically mergeable but the consumer's ruleset (gitflow-protect-integration) requires code owner review from @InditexTech/swagger-ui-plugin-diff-highlight-maintainers (= bpedro, amagan), and the bot PR's require_extra_approval_for_unattributed_changes=true adds a second required approval that the maintainer team cannot self-grant for their own generated SYNC. No bypass actor configured for that ruleset.

The --delete-branch flag removes automated/ci-governance-sync so the next planner dispatch creates a fresh branch from current develop (ahead_by=0, well inside the window).

If the maintainers want this SYNC's manifest content preserved, they can re-open or re-sync manually.