[WAF-03] Define allocator, ownership, concurrency, and hot-reload contracts

Objective

Record ADRs and public contracts for byte ownership, allocator lifetimes, immutable rulesets, transaction isolation, connector responsibilities, errors, feature flags, and atomic hot reload.

Deliverables

• Implement the complete scoped behavior described above.
• Keep request-path work independent from UI, PostgreSQL, and blocking audit I/O.
• Use Zig 0.17-dev and dependencies pinned through Pantry; do not add Git submodules.
• Keep public APIs explicit about ownership, resource limits, errors, security policy, and compatibility.
• Add focused unit, integration, differential, fuzz, benchmark, and documentation coverage as applicable.

Acceptance criteria

• The scoped implementation and tests are merged on main in small conventional commits.
• Zig formatting, focused tests, and the relevant CI suite pass.
• Compatibility claims have executable evidence and no unexplained skips or silent fallbacks.
• Untrusted inputs have deterministic bounds; hot paths have benchmark evidence.
• Documentation and the machine-readable compatibility matrix are updated.

Relationships

• Parent: WAF-00

Blocked by

• WAF-02

Blocks

• WAF-05
• WAF-06
• WAF-10
• WAF-22
• WAF-48

Baselines

• ModSecurity 3.0.16
• Coraza 3.7.0
• OWASP CRS 4.28.0
• libinjection 4.0.0
• Zig 0.17-dev resolved and locked through Pantry

Ownership/concurrency foundation shipped in f1e24b7: stable allocated Waf ownership, immutable configuration, atomic live-transaction accounting, early-destroy rejection, isolated transaction state, deterministic input bounds, and documented hot-reload reclamation contract. CI passed: https://github.com/zig-utils/zig-waf/actions/runs/29893318643. The issue remains open for compiled-plan reclamation and allocator benchmarking.

Completed in small main commits: acc0147d7648d8871d96911776f564fa65b711fa adds explicit native/C feature discovery, exclusive generation ownership, atomic publication, retirement handles, drain-before-reclaim behavior, shutdown errors, and concurrent request/reload stress coverage; 6903a93ade564ce866d8ca936863f14e8d9e75b7 adds the accepted ownership/concurrency/hot-reload ADR, architecture references, compatibility evidence, and the repeatable bench-ownership gate; 9c76e96762c25ece7f31f4f3f1701397fce30d53 and f87a8d75d18d331c1d0bc96028cf260a53226997 make CI verify every checked-out repository against dependencies.lock.json and run the ownership benchmark. Local checks passed for formatting, unit/C smoke tests, native compile, x86_64 Linux cross-compile, and ReleaseFast benchmark (245 ns direct creation, 299 ns runtime pinning in the recorded local run). Final hosted CI is green: https://github.com/zig-utils/zig-waf/actions/runs/29931589299. Compiled execution-plan representation remains correctly scoped to WAF-11 and must preserve this completed contract.