ci: add SonarCloud analysis with JaCoCo coverage

[nyg]

Adds SonarCloud analysis (project nyg_kraken-api-java) with JaCoCo coverage, following the setup used in jmxsh and wiktionary-to-kindle.

Changes

• Parent POM: adds jacoco-maven-plugin 0.8.15 (prepare-agent, and report in the default verify phase) and sonar-maven-plugin 5.7.0.6970, pinned so Renovate can bump it. Adds the SonarCloud organization, project key and host URL. The JaCoCo XML report path uses ${project.build.directory}, which resolves per module, so the library module reports its own library/target/site/jacoco/jacoco.xml.
• examples module: sets sonar.skip. It is demo code, has no tests and is not published, so analysing it would only pull coverage down.
• Workflow: pr-build.yml becomes java-ci.yaml (named Java CI, like the other repositories). It now also runs on pushes to master, which gives SonarCloud the main-branch baseline that PRs are compared against, and on workflow_dispatch. It checks out the full history (fetch-depth: 0) for new-code detection, caches Maven dependencies and runs mvn clean verify instead of package, because the JaCoCo report is created in verify. The job is still named build.
• AGENTS.md: updates the CI description.

Design notes

• The build and the analysis run in a single mvn clean verify sonar:sonar invocation, not in two steps as in wiktionary-to-kindle. That project has one module. Here, a standalone mvn sonar:sonar would have to resolve the kraken-api snapshot for the examples module, but the snapshot is neither in the runner's local repository nor packaged in that Maven session.
• The sonar:sonar goal is only added when SONAR_TOKEN is set, so PRs from forks and Dependabot, which get no secrets, still build and test.
• Surefire has no <argLine>, so it picks up the JaCoCo agent through the argLine property that prepare-agent sets.

Validation

• mvn clean verify sonar:sonar -Dsonar.skip=true locally on Temurin 25: all 594 tests pass and library/target/site/jacoco/jacoco.xml is generated (95.5% line coverage, 85.5% branch coverage). The examples module produces no report because it has no tests. The Sonar plugin resolves and runs from the reactor root.
• This PR's own CI run performs the first real analysis.