If I have a Query using SQL surely I can do the basic steps of

while (resultSet.next()) {
// do something with one row
}

But there appears to be now such method on the Query object. Trying to use the Iterator fails.

This is quite surprising, along the lines of losing access to the meta data which the basic JDBC implementation provides from the java.sql packages.

Do I have to write two sets of code - one for JDBC for dynamic SQL and reports and 'efficient' coding, the other using Hibernate for object access?

To me, what your showing is pure JDBC approach. Which is fine but your not using hibernates APIs. HIbernate provides a collection as the results set so you interate over it using java.util.Iterator (or jdk5 for loop). There might be cases where you need to go to the JDBC level to accomplish something (which will not be often at all). Report queries can be performed efficiently using Hibernate but you may have cases where you decided to employ JDBC level code. I do not see this as being necessarily bad.

I would be happy if the Hibernate iterator worked for SQL queries, so I can iterate over the array of objects returned.

But it doesnt so I can do nothing but return the entire resultset which forces me to change my architecture if I want to continue to not use JDBC.