fix: satisfy PMD 7.27.0 across the reactor

[joaodinissf]

Summary

Upgrade PMD from 7.26.0 to 7.27.0 and address only the reproduced warnings, without optional refactoring. The version bump from Dependabot #1514 is included; close #1514 after this PR merges.

Scope

The unfixed PR base with PMD 7.27 produces 24 violations across 19 Java files: 4 InstantiableUtilityClass, 13 ProtectedMemberInFinalClass, 4 ReturnEmptyCollectionRatherThanNull, and 3 UnusedReturnValue. Report generation across all modules was necessary because the normal fail-at-end check skips downstream modules after the initial failures.

• Preserve four exported utility classes' non-final declarations and protected constructors with targeted compatibility suppressions.
• Narrow non-overriding implementation members to private or package-private; preserve injection and same-package constructor access.
• Preserve the three existing exception-based existence searches with documented UnusedReturnValue suppressions. No lambda conversions, getter caching, or search-strategy changes are included.
• Remove redundant always-null local branches in the two validation-element collection methods. Preserve the meaningful proxy-node null sentinel with a targeted suppression.
• Initialize tableItems' result to an empty list, consistent with its documented non-null return contract. This warning-related change can replace a null result with an empty list if the table becomes empty after the wait. The pre-existing per-row overwrite bug remains separate in fix: accumulate all rows in CoreSwtbotTools.tableItems #1516.
• Retain the private loading helper; only its visibility changes.
• Include necessary plugin/feature version metadata. Remove Index's constructor @return tag because local Checkstyle rejects it; unrelated comment cleanup is excluded.

Optional simplifications and their behavioral tests are being submitted in a separate dependent draft PR. They are not prerequisites for merging this PMD update.

Validation

The warning audit used Java 21 and CI's exact Maven PMD/CPD goals on macOS. The original five blocking CI findings reproduced, and report-only execution exposed all 24 findings across 62 PMD reports; 62 CPD reports contained no duplicates.

Full local verification and quality checks passed on head 296d03baa: Maven verify, Checkstyle, PMD, CPD, and SpotBugs. The aggregate suite reported 354 tests, 0 failures, 0 errors, and 2 skipped. This was Java 21 on macOS, using the repository's macOS UI profile. Fresh remote checks are still required on this head; previous-head CI is not evidence for this revision.

Keep draft with no reviewer requests pending validation and review.

---

Re-homed from #1515: the branch moved from the fork to upstream so the dependent PR can be linked as a native stack (GitHub rejects fork PRs in stacks). Content is identical — same head commit 296d03ba.

🤖 Generated with Claude Code