[REGEX-05] Make regex compilation allocation-failure safe

Objective

Make regex parser/AST construction fully rollback-safe under allocator failure so WAF runtime control compilation cannot leak or retain partially owned nodes.

Deliverables

• Fix parseConcat ownership when node-list growth fails.
• Fix concatenation-tree ownership across intermediate parent allocation failures.
• Add exhaustive allocation-failure coverage around representative regex compilation.
• Run the zig-regex test suite with Zig 0.17-dev through Pantry.

Acceptance criteria

• No leaks, double frees, or invalid ownership under std.testing.checkAllAllocationFailures.
• Existing syntax and matching tests remain green.
• Small conventional commit pushed directly to main as Chris without touching the preserved untracked zig-regex checkout entry.

Relationships

• Parent: REGEX-03 #16
• Discovered by: zig-waf WAF-15 #16
• Blocks bounded runtime regex target exclusions in zig-waf.

Implemented and pushed to main in 957013d.

The parser now releases partially owned concat, alternation, and character-class trees when any parent/list allocation fails. Added an exhaustive allocation-failure regression covering 43 allocation points in a representative anchored expression.

Local qualification (Pantry Zig 0.17.0-dev.1441+d5181a9):

• zig test src/parser.zig --test-filter "parser tree ownership"
• zig build test --summary failures

This unblocks regex-delimited runtime target exclusions in zig-waf#16. Keeping this issue open until hosted CI is green for the exact commit.

Follow-up integration hardening landed on main in 1b2293e.

The WAF allocator-failure suite exposed and this commit fixes the remaining compile-pipeline ownership paths:

• optimizer analysis now releases already-published hints on later failure;
• Thompson compilation no longer deinitializes the AST twice on failure;
• NFA state insertion takes ownership of transition payloads and releases them if list growth fails;
• exhaustive Regex.compile allocation-failure coverage was added.

Local evidence:

• exhaustive regex compile test: pass
• downstream zig-waf suite: 218/218 pass

Awaiting hosted CI for exact SHA 1b2293e before closure.

Completed on main by 957013d and 1b2293e. Exact-SHA hosted CI is green: run 29963261202, including the primary test job and x86_64/aarch64 Linux/macOS plus Windows build targets.

Acceptance evidence:

• exhaustive parser-tree allocation failures: green;
• exhaustive optimizer/whole-compile allocation failures: green;
• no leaks, double frees, swallowed OOM, or invalid ownership;
• downstream zig-waf 218-test suite green locally with the pinned commit;
• preserved untracked zig-regex checkout entry was not modified.

This unblocks zig-waf#16.