CI/CD: Trigger-Based Tool Execution

Each enforcement tool runs under a different trigger policy, balancing feedback speed against pipeline cost. Fast, cheap tools run on every push; expensive, context-heavy tools run only on PRs or pre-release.

Tool → Trigger mapping: - Checkstyle: every push (seconds) - SpotBugs: every push (seconds) - SonarQube: on PR only (needs build context, minutes) - ArchUnit: as part of test suite (runs with mvn test) - OpenRewrite dry-run: before release only (produces large diffs)

Considered options: - All tools on every push — simple but wasteful; SonarQube alone adds minutes. - All tools on PR only — slow feedback; developers batch pushes and discover issues late. - Trigger-based — right tool at the right time.

Consequences: - The pipeline config becomes per-tool, not monolithic — each tool is independently toggleable. - SonarQube quality gate results are posted as PR comments, giving reviewers a summary. - OpenRewrite dry-run output is attached as a release artifact, not blocking日常 development.