feat: add Python and Java regex engines

docs/PORTAL_REQUIREMENTS.md

@@ -9,17 +9,23 @@ Required delivery behavior:
   revalidation/no-cache resources.
 - Hashed Vite assets may use immutable long-term caching.
 - CSP must allow `worker-src 'self' blob:`.
-- `engines/pcre2/pcre2.wasm` must use `application/wasm`.
+- `engines/pcre2/pcre2.wasm` and
+  `engines/python/pyodide.asm.wasm` must use `application/wasm`.
+- Engine `.mjs` files must use a JavaScript MIME type;
+  `engines/python/python_stdlib.zip`, JSON, licence, notice and checksum files
+  must be delivered without content transformation.
 - `script-src` must permit self-hosted WebAssembly compilation, normally with
   `'wasm-unsafe-eval'`; broad `'unsafe-eval'` is neither needed nor recommended.
-- `engines/pcre2/pcre2.mjs`, metadata, checksums, licence and WASM should use
-  revalidation or a release-scoped immutable cache. They are not
+- `connect-src 'self'` must allow the Pyodide worker to fetch its own
+  same-origin WebAssembly, standard-library and lock files.
+- Every file below `engines/pcre2/`, `engines/python/` and `engines/java/`
+  should use revalidation or a release-scoped immutable cache. These are not
   content-hashed filenames and must never drift under one release identity.
 
 The Portal must consume the immutable release ZIP, verify its SHA-256, verify
-manifest ID `de.add-ideas.regex-tools` and version `0.2.0`, and mount it at a
+manifest ID `de.add-ideas.regex-tools` and version `0.3.0`, and mount it at a
 relative target such as `apps/regex/`.
 
-The package, manifest, tag, artifact URL and checksum must all use the v0.2.0
-identity. The historical v0.1.0 artifact coordinates remain immutable and must
-not be overwritten or reused.
+The package, manifest, tag, artifact URL and checksum must all use the v0.3.0
+identity. Historical artifact coordinates remain immutable and must not be
+overwritten or reused.