[REGEX-00] Epic: PCRE and CRS compatibility

[chrisbbreuer]

Objective

Make zig-regex the bounded production matcher for CRS 4.28 and the stable ModSecurity/Coraza rule union, with PCRE2 retained only as a conformance oracle.

Deliverables

• Implement the complete scoped behavior without Git submodules.
• Keep public APIs explicit about ownership, resource limits, and errors.
• Add focused unit, integration, compatibility, fuzz, and benchmark coverage as applicable.
• Update documentation and machine-readable compatibility status.

Acceptance criteria

• The scoped implementation and tests are merged on main.
• Zig formatting, focused tests, and the repository CI suite pass.
• No unexplained compatibility skips, silent fallbacks, leaks, or unbounded hostile-input paths remain.
• Benchmarks or security evidence is attached when this affects a hot or untrusted path.

Relationships

• Parent: Top-level tracking epic

Blocked by

None

Blocks

None

Roadmap

• REGEX-01: Add PCRE2 and CRS differential testing
• REGEX-02: Close syntax, capture, Unicode, and matching-semantic gaps
• REGEX-03: Add bounded execution, prefilters, and ruleset caches
• REGEX-04: Publish the CRS-ready release

Baselines

• Zig 0.17-dev resolved and locked through Pantry.
• ModSecurity 3.0.16, Coraza 3.7.0, CRS 4.28.0, and libinjection 4.0.0 where applicable.