[WAF-63] Build ruleset authoring, validation, diff, rollout, and rollback

[chrisbbreuer]

Objective

Build a SecLang editor with diagnostics, completion, source locations, version diff, validation, signing, targeting, canaries, rollout progress, and rollback.

Deliverables

• Implement the complete scoped behavior described above.
• Keep request-path work independent from UI, PostgreSQL, and blocking audit I/O.
• Use Zig 0.17-dev and dependencies pinned through Pantry; do not add Git submodules.
• Keep public APIs explicit about ownership, resource limits, errors, security policy, and compatibility.
• Add focused unit, integration, differential, fuzz, benchmark, and documentation coverage as applicable.

Acceptance criteria

• The scoped implementation and tests are merged on main in small conventional commits.
• Zig formatting, focused tests, and the relevant CI suite pass.
• Compatibility claims have executable evidence and no unexplained skips or silent fallbacks.
• Untrusted inputs have deterministic bounds; hot paths have benchmark evidence.
• Documentation and the machine-readable compatibility matrix are updated.

Relationships

• Parent: WAF-00

Blocked by

• WAF-12
• WAF-13
• WAF-33
• WAF-53
• WAF-60

Blocks

• WAF-64
• WAF-70

Baselines

• ModSecurity 3.0.16
• Coraza 3.7.0
• OWASP CRS 4.28.0
• libinjection 4.0.0
• Zig 0.17-dev resolved and locked through Pantry

[chrisbbreuer]

Dependency #13 is complete at 8ee46c3, with hosted qualification green. The typed immutable directive configuration and semantic fingerprint are now available to the STX ruleset workflow.

[chrisbbreuer]

WAF-13 #14 is complete and closed at 7d903f0; ruleset authoring/rollout may now consume immutable defaults/removals/target/action updates, structured missing-reference warnings, source provenance, and authenticated remote-source evidence.