... So that we are made aware of issues during the PR review, not after the PR is merged.

Sonar only reports issues in modified code, so I think it makes sense.

See https://sonarcloud.io/documentation/integrations/github#activating-pull-request-decoration