ci(smoke-agent-linux): waive JLine's Java 22 FFM provider in the bytecode gate

[bernardladenthin]

Summary

• smoke-agent-linux fails on main (run 36320808474, job 108667860018) in its "Verify Java 21 bytecode" step. The cause is JLine 4.4.6, which ships org/jline/terminal/impl/ffm/* (25 classes) as class-file major 66 (Java 22).
• Those classes are JLine's optional Foreign Function & Memory terminal provider. JLine finds them only through META-INF/jline/providers/ffm. On Java 21, JLine uses its JNI provider; if FFM is forced, it falls back to a dumb terminal instead of failing (checked on 21.0.10). The classes are never loaded on the runtime the agent targets.
• This change adds a scoped --allow 'llama-atmosphere-agent-*:org/jline/terminal/impl/ffm/*' for that one package. Any other class above major 65 in the agent jar still fails the gate. The waiver is documented in CLAUDE.md's agent section.

smoke-agent-linux is required by both publish-snapshot and publish-release, so this blocks every snapshot and release until merged. The fix was pushed after #458 merged, so it never reached main.

Test plan

• Affected checks run locally: the bytecode gate against the built agent jar returns rc=0 with the allow (25 entries waived) and rc=1 without it
• CI is green on this branch. This is the first run in which the smoke's model steps execute: the jar alone fails without a core, --help, the 2 + 2 answer, and the read_file marker round.
• Docs / CHANGELOG updated where applicable (CLAUDE.md)

Related issues / PRs

Follow-up to #457 and #458.

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes

🤖 Generated with Claude Code

https://claude.ai/code/session_01QSXAwbXqx9u5xsMArMvgT8

---

Generated by Claude Code

[bernardladenthin]

Two checks are red that are not caused by this PR:

• Verify GPG signing key (no secrets printed)
• Verify GPG signing key — Gradle/BouncyCastle path (no secrets printed)

Both jobs run in the maven-central environment and failed within 1–2 s without writing a log. The previous PR run on this branch (36320769217, commit 80c08dc, the #458 run) failed the same way. On a PR ref the environment's secrets are not available, so these jobs cannot pass on any PR branch, and a re-run would fail the same way. This PR changes only the smoke-agent-linux bytecode step and a line in CLAUDE.md, neither of which affects these jobs. No change on this branch can fix them.

The check that matters here is smoke-agent-linux. It runs once the start gate passes.

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud