[REGEX-01] Add PCRE2 and CRS differential testing

Objective

Compile every CRS 4.28 expression and compare compile results, matches, captures, offsets, flags, and errors against Pantry-provided PCRE2 using a pinned corpus.

Deliverables

• Implement the complete scoped behavior without Git submodules.
• Keep public APIs explicit about ownership, resource limits, and errors.
• Add focused unit, integration, compatibility, fuzz, and benchmark coverage as applicable.
• Update documentation and machine-readable compatibility status.

Acceptance criteria

• The scoped implementation and tests are merged on main.
• Zig formatting, focused tests, and the repository CI suite pass.
• No unexplained compatibility skips, silent fallbacks, leaks, or unbounded hostile-input paths remain.
• Benchmarks or security evidence is attached when this affects a hot or untrusted path.

Relationships

• Parent: REGEX-00

Blocked by

None

Blocks

• REGEX-02
• REGEX-03

Baselines

• Zig 0.17-dev resolved and locked through Pantry.
• ModSecurity 3.0.16, Coraza 3.7.0, CRS 4.28.0, and libinjection 4.0.0 where applicable.

Initial oracle/toolchain slice shipped in 2a26891: Pantry now pins Zig 0.17.0-dev.1441+d5181a9 and PCRE2 10.47.0 as the conformance oracle, CI uses the same Zig build, and formatter migrations are complete. The pre-existing untracked zig-regex/ path was inspected, found to be an empty directory, and intentionally left untouched. This issue remains open for the CRS extraction and PCRE2 differential runner.

Implementation update: commit b8ca89df644976801e0b6444419444b708eeaa25 pins Zig 0.17-dev and PCRE2 10.47.0 through Pantry, adds the bounded test-core CI gate, and keeps host-specific benchmark executables out of normal cross-target installs. The full CI matrix is green for tests plus x86_64/aarch64 Linux/macOS and x86_64 Windows: https://github.com/zig-utils/zig-regex/actions/runs/29895566899. The pre-existing untracked empty zig-regex/ directory remains untouched.