The rule S2129 complains about using the String constructor in general and encourages to use valueOf() instead. That’s a good approach. But in case of a byte[] array argument, there is no corresponding valueOf(). Hence the rule should not hit.
Well, you could argument, not to use String constructor with byte[] argument WITHOUT a charset. Well, that would be worth a warning, I guess. And I think, something like this is done by another rule. But there are cases, where conversion without charset makes sense.
I can not reproduce a S2129 issue on a new String(byte[]) constructor, I only have a S1943 issue complaining about the missing encoding.
And about the String class, the rule S2129 only reports on new String() and new String(String), it is supposed to recommend the usage of "" or a direct value like "Hello world", which seems correct. But I assume that the message is not enough clear, because you spoke about valueOf() which should not apply on String. So I created SONARJAVA-3837 to improve the message.