[WAF-35] Add ModSecurity 3.0.16 differential regression tests

Objective

Compare parser acceptance, matches, captures, phases, interventions, variables, bodies, persistent collections, and audit output against the pinned ModSecurity release.

Deliverables

• Implement the complete scoped behavior described above.
• Keep request-path work independent from UI, PostgreSQL, and blocking audit I/O.
• Use Zig 0.17-dev and dependencies pinned through Pantry; do not add Git submodules.
• Keep public APIs explicit about ownership, resource limits, errors, security policy, and compatibility.
• Add focused unit, integration, differential, fuzz, benchmark, and documentation coverage as applicable.

Acceptance criteria

• The scoped implementation and tests are merged on main in small conventional commits.
• Zig formatting, focused tests, and the relevant CI suite pass.
• Compatibility claims have executable evidence and no unexplained skips or silent fallbacks.
• Untrusted inputs have deterministic bounds; hot paths have benchmark evidence.
• Documentation and the machine-readable compatibility matrix are updated.

Relationships

• Parent: WAF-00

Blocked by

• WAF-12
• WAF-16
• WAF-17
• WAF-23
• WAF-24
• WAF-25
• WAF-26
• WAF-27
• WAF-28
• WAF-29

Blocks

• WAF-37
• WAF-68

Baselines

• ModSecurity 3.0.16
• Coraza 3.7.0
• OWASP CRS 4.28.0
• libinjection 4.0.0
• Zig 0.17-dev resolved and locked through Pantry

WAF-09 (#10) now explicitly blocks this scope. Its implementation contract covers bounded TX mutation plus persistent IP/SESSION/USER/GLOBAL/RESOURCE initialization, expiration, atomic conflict-safe updates, failure policy, and real Pantry-managed LMDB persistence.

Do not duplicate or weaken those semantics here; consume the WAF-09 engine/backend APIs once qualified.

WAF-09 (#10) is complete on main and hosted-qualified: https://github.com/zig-utils/zig-waf/actions/runs/29939075574

This issue may now consume the stable TX/persistent collection, action-facing identity binding, expiry, atomic mutation, failure-policy, capability-discovery, in-memory, and LMDB contracts. Preserve typed errors and do not add an alternate persistence path.

Dependency #13 is complete at 8ee46c3, with hosted qualification green. The exact ModSecurity directive inventory and executable schema evidence are available for WAF-35 differential work.