fix: publish LCOV in Sonar CI so PR quality gate passes

Co-authored-by: Cursor <cursoragent@cursor.com>

src/env.test.ts

@@ -0,0 +1,25 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { loadDotEnv } from "./env.js";
+
+test("loadDotEnv loads missing keys from .env without overriding", () => {
+  const dir = mkdtempSync(join(tmpdir(), "ticketlab-env-"));
+  const key = `TICKETLAB_ENV_TEST_${Date.now()}`;
+  try {
+    writeFileSync(join(dir, ".env"), `${key}=from-file\n# comment\nOTHER=1\n`, "utf8");
+    delete process.env[key];
+    loadDotEnv(dir);
+    assert.equal(process.env[key], "from-file");
+
+    process.env[key] = "already-set";
+    writeFileSync(join(dir, ".env"), `${key}=should-not-win\n`, "utf8");
+    loadDotEnv(dir);
+    assert.equal(process.env[key], "already-set");
+  } finally {
+    delete process.env[key];
+    rmSync(dir, { recursive: true, force: true });
+  }
+});