feat: add Python and Java regex engines

docs/ENGINE_BUILDS.md

@@ -1,9 +1,9 @@
 # Engine builds
 
 The production application uses the browser's native `RegExp` for ECMAScript
-and bundles a verified PCRE2 10.47 WebAssembly pack. Normal application builds
-never download or compile an engine: the reviewed files under
-`public/engines/pcre2/` are copied into `dist/` and verified there.
+and bundles verified PCRE2, Python and Java runtime packs. Normal application
+builds never download or compile an engine: reviewed files under
+`public/engines/` are copied into `dist/` and verified there.
 
 ## Rebuilding PCRE2
 
@@ -52,7 +52,77 @@ The immutable signed-tag object is pinned. OpenPGP trust validation remains a
 release-operator step because the offline builder does not install or trust a
 key.
 
-## Runtime boundary
+## Installing the Python pack
+
+The Python pack is derived from the exact `pyodide@314.0.3` npm package locked
+with integrity:
+
+```text
+sha512-sK40My6m8tmBUYtYH9au9rXUeh9x0wfahtHdOlGmJxZDsKBGKtP6KznyFB2+u/klbQTdDionR0uaVd176zVQzQ==
+```
+
+That Pyodide release is tag/commit
+`ac57031be7564f864d061cb37c5c152e59f83ad4`. Direct executable identity
+verification reports CPython 3.14.2; the shipped `pyodide-lock.json`
+independently reports `info.python` as 3.14.0, and the verifier records rather
+than conflates those two upstream identities. The pack copies only the reviewed
+loader, WebAssembly runtime, Python standard library and lock metadata required
+for a local CPython `re` worker. It adds deterministic engine metadata, a
+closed-file-set checksum manifest and exact Pyodide/CPython licence material.
+
+The install operation reads from the already installed pinned npm package. It
+does not contact a CDN or package index. It verifies source package identity,
+file hashes, runtime metadata and licence inputs before atomically replacing
+only `public/engines/python/`. The distribution verifier checks the same closed
+set under `dist/`, validates WebAssembly magic and confirms that all runtime
+references remain relative and self-hosted.
+
+```sh
+node scripts/python-engine-pack.mjs \
+  node_modules/pyodide \
+  .engine-build/python
+node scripts/install-python-engine.mjs .engine-build/python
+```
+
+The installed closed set is:
+
+- `pyodide.mjs`, `pyodide.asm.mjs` and `pyodide.asm.wasm`;
+- `python_stdlib.zip` and `pyodide-lock.json`;
+- `engine-metadata.json` and `SHA256SUMS`; and
+- `LICENSE.pyodide.txt` and `LICENSE.cpython.txt`.
+
+## Building the Java pack
+
+The Java bridge under `engines/java/` wraps TeaVM 0.15.0
+`java.util.regex.Pattern` and `Matcher`. TeaVM tag/commit
+`ee91b03e616c4b45401cd11fb0cd7eb0daf6649b` is pinned through the Maven build.
+The build produces a minified ES2015 module without source maps, source files,
+remote imports or an OpenJDK runtime.
+
+The pack gate verifies the Maven coordinates, bridge source identity, TeaVM
+engine identity and self-test, generated module, deterministic metadata,
+checksums, Apache-2.0 licence and TeaVM NOTICE. Only the verified pack is
+installed under `public/engines/java/`.
+
+```sh
+node scripts/java-engine-pack.mjs
+node scripts/install-java-engine.mjs
+```
+
+The pack command performs two clean offline Maven builds and requires identical
+output. The installed closed set is `java-regex.mjs`,
+`engine-metadata.json`, `SHA256SUMS`, `LICENSE.txt` and `NOTICE.txt`.
+
+TeaVM supplies its own Apache Harmony-derived class-library implementation.
+The resulting engine is therefore identified as
+`TeaVM java.util.regex 0.15.0`, not OpenJDK. TeaVM 0.15.0 does not implement
+OpenJDK's `Pattern.UNICODE_CHARACTER_CLASS`; the bridge treats the application
+`U` flag as a compatibility request, implies Unicode case folding and reports
+that predefined-character classes and word boundaries retain TeaVM behaviour.
+
+## Runtime boundaries
+
+### PCRE2
 
 ABI version 3 has no retained native handles. Each call compiles, obtains
 capture names, matches/substitutes or traces and releases its code, match data
@@ -72,3 +142,24 @@ Normal execution lives only in `pcre2.worker`. Instrumented
 never call it. Each supervisor terminates its worker on timeout, crash,
 cancellation or supersession and lazily creates a clean generation for the
 next request.
+
+### Python
+
+The Python worker loads the self-hosted Pyodide pack and verifies Pyodide,
+CPython and `re` identities before accepting work. The application bridge is
+evaluated inside that interpreter and exposes bounded compile, match and native
+replacement operations. It reports CPython's Unicode code-point positions;
+the TypeScript adapter retains them and converts only valid boundaries to
+half-open editor UTF-16 ranges. Runtime load has a separate startup deadline.
+Execution timeout, cancellation or crash terminates the worker and its complete
+Python/WebAssembly heap.
+
+### Java
+
+The Java worker imports the self-hosted TeaVM ES module and checks the bridge
+ABI, declared engine identity and compiled self-test before accepting work.
+Every request compiles a `Pattern`, obtains bounded `Matcher` results or native
+replacement output, and returns native half-open UTF-16 ranges. No Java virtual
+machine, OpenJDK classes, remote service or ECMAScript regex fallback is
+involved. Runtime load has a separate startup deadline; termination discards
+the complete worker module state.