[peter-lawrey]

Maven's sonar profile prepares surefireArgLine, but the default test execution expands it before JaCoCo runs and the non-compact-string executions use a different property. Both JVM paths therefore run without the agent and silently skip coverage reporting/checking.

Use late evaluation of surefireArgLine for every unit-test execution. Keep Maven verification in the existing Build check, require its JaCoCo XML to exist, and give SonarCloud analysis its own dependent job consuming the verified classes and coverage artifact. Move the Actions/JDK updates and testing-strategy note out of seed-contract PR #120. No failure is suppressed.

Validation on Linux x86-64, OpenJDK 21, Maven 3.9.11, isolated cached dependencies:

• Before: focused mvn -Psonar -Dtest=MurmurHash3Test -X clean verify passes, but both fork commands lack -javaagent and target/jacoco.exec is absent.
• After: full mvn -Psonar -X clean verify passes two 14,901-case unit executions (5 and 8 skips), plus the automatic-module-name integration test. All 38 unit-test forks receive the JaCoCo agent, including all 19 non-compact-string forks.
• JaCoCo reports 1,797/1,976 lines (90.9%) and 262/311 branches (84.2%); existing coverage thresholds pass. Effective POM and actual fork commands were inspected.
• git diff --check passes.
• Fresh Actions run 34696556693 executes this head's workflow: the separate Build job passes, classes/coverage upload and download succeed, and only the SonarCloud analysis job fails with the same authentication/project-access error.

The remaining Sonar blocker is now classified as rejection of the configured credential. Run 34697089926 at 88a87c46f293e4dba01cc9bc882207ca9956e060 again passes Build and the artifact transfer; the added authentication check receives valid: false from SonarCloud for SONAR_TOKEN and fails explicitly before scanning. The check sends the credential only to SonarCloud and does not print its value. Job 103523545730 supplies a masked SONAR_TOKEN and fails with Not authorized or project not found after successful tests. The public SonarCloud project API confirms project OpenHFT_Zero-Allocation-Hashing belongs to organisation openhft. The available GitHub credential cannot inspect organisation secret metadata (HTTP 403). An administrator must replace or repair the configured credential, confirm its analysis permission for this project, and rerun analysis. Token expiry is not established by this result. Keep this repair draft until analysis succeeds.

The property wiring follows JaCoCo's prepare-agent guidance.