[WAF-64] Build the event-driven exclusion wizard

[chrisbbreuer]

Objective

Generate scoped exclusions from real events, preview blast radius, validate through replay, attach rationale, and submit versioned policy changes.

Deliverables

• Implement the complete scoped behavior described above.
• Keep request-path work independent from UI, PostgreSQL, and blocking audit I/O.
• Use Zig 0.17-dev and dependencies pinned through Pantry; do not add Git submodules.
• Keep public APIs explicit about ownership, resource limits, errors, security policy, and compatibility.
• Add focused unit, integration, differential, fuzz, benchmark, and documentation coverage as applicable.

Acceptance criteria

• The scoped implementation and tests are merged on main in small conventional commits.
• Zig formatting, focused tests, and the relevant CI suite pass.
• Compatibility claims have executable evidence and no unexplained skips or silent fallbacks.
• Untrusted inputs have deterministic bounds; hot paths have benchmark evidence.
• Documentation and the machine-readable compatibility matrix are updated.

Relationships

• Parent: WAF-00

Blocked by

• WAF-13
• WAF-55
• WAF-63

Blocks

• WAF-70

Baselines

• ModSecurity 3.0.16
• Coraza 3.7.0
• OWASP CRS 4.28.0
• libinjection 4.0.0
• Zig 0.17-dev resolved and locked through Pantry

[chrisbbreuer]

WAF-13 #14 is complete and closed at 7d903f0; the exclusion wizard may now emit bounded ID/tag/msg removals and ordered target/action updates with strict validation and immutable evidence.