ci(smoke-agent-linux): waive JLine's Java 22 FFM provider in the bytecode gate

.github/workflows/publish.yml

@@ -3721,8 +3721,16 @@ jobs:
           distribution: 'temurin'
           java-version: ${{ env.JAVA_VERSION }}
       # The agent is Java 21 (Atmosphere's floor), unlike the Java 8 core: its ceiling is 65.
+      # One waiver: JLine ships its FFM terminal provider (org/jline/terminal/impl/ffm, 25 classes)
+      # as Java 22 bytecode. It is discovered through META-INF/jline/providers/ffm, not loaded
+      # eagerly: on Java 21 JLine picks its JNI provider, and a forced FFM provider falls back to a
+      # dumb terminal instead of failing (verified on 21.0.10). Only that package is waived, so
+      # any other class above 65 still fails the gate.
       - name: Verify Java 21 bytecode (no class newer than major 65)
-        run: .github/verify-bytecode-version.sh --max-major 65 agent-assets/llama-atmosphere-agent-*-jar-with-dependencies.jar
+        run: >
+          .github/verify-bytecode-version.sh --max-major 65
+          --allow 'llama-atmosphere-agent-*:org/jline/terminal/impl/ffm/*'
+          agent-assets/llama-atmosphere-agent-*-jar-with-dependencies.jar
       - name: Run the agent release-jar smoke test
         run: .github/smoke-agent-jar.sh agent-assets "models/${TOOL_MODEL_NAME}"
       - name: Upload agent logs

CLAUDE.md

@@ -2223,7 +2223,7 @@ CI wiring (`publish.yml`): the model-free job builds it, writes the `.sha256` an
 directory next to `llama-fatjars`, so `sign-fatjars.sh` signs it (`*-jar-with-dependencies*.jar`) and
 the one upload attaches it. **`smoke-agent-linux`** (`.github/smoke-agent-jar.sh`) runs the asset the
 way the README tells a user to — `java -jar` next to the real `all-linux-x86-64` fat jar — and checks:
-bytecode ≤ 65 (Java 21, unlike the core's 52), that the jar started **alone** fails with
+bytecode ≤ 65 (Java 21, unlike the core's 52 — with one `--allow` for JLine's FFM terminal provider `org/jline/terminal/impl/ffm/*`, 25 classes shipped as Java 22 bytecode that JLine discovers through `META-INF/jline/providers/ffm` and never loads on 21, where it picks its JNI provider; the first CI run of the smoke caught them), that the jar started **alone** fails with
 `NoClassDefFoundError: net/ladenthin/llama/LlamaModel` (i.e. it really carries no core), `--help`, a
 one-shot `2 + 2` answer and a `read_file` round that must surface a marker from `--workspace`, all on
 the cached `TOOL_MODEL_NAME` with `--ngl 0`. **All three agent jobs gate both publish jobs**