feat: add Python and Java regex engines

docs/SECURITY.md

@@ -19,6 +19,18 @@ untrusted.
 - PCRE2 runs only in mandatory UTF/UCP mode. Exact UTF-8 byte boundaries are
   normalized to editor UTF-16 offsets; lone surrogates are rejected instead of
   being silently replaced by browser encoding.
+- Python starts only after the worker verifies Pyodide, CPython and `re`
+  identities. Pattern, subject, flags and replacement remain string data passed
+  to the fixed application bridge; no user-supplied Python source is evaluated.
+  Native code-point boundaries are checked before conversion to editor UTF-16.
+- Java starts only after the worker verifies the TeaVM bridge ABI, engine
+  identity and compiled self-test. It exposes only fixed bounded
+  `Pattern`/`Matcher` entry points; no JVM, Java class loading or user-supplied
+  JavaScript is available. The runtime is TeaVM, not OpenJDK.
+- Every bundled engine directory has a closed file set, deterministic
+  metadata/checksums and licence material verified both before installation and
+  in `dist/`. Runtime imports and fetches resolve only against the same-origin
+  release path.
 - Replacement templates are strings; executable callbacks are unavailable.
 - Replacement/list token decorations, rows, chips, diagnostics and list
   evaluation work have separate presentation/operation caps; incomplete list
@@ -72,10 +84,14 @@ untrusted.
   predicate check runs in the selected killable engine worker. Timeout, crash,
   cancellation and worker error remain distinct; truncated results fail
   closed. Subjects and results are ephemeral and never uploaded or persisted.
-- No backend, uploads, telemetry, remote corpus URL, CDN, remote font, `eval`,
-  `Function`, arbitrary command line or unsafe HTML rendering exists.
+- No backend, uploads, telemetry, remote corpus URL, CDN, remote font,
+  arbitrary command line or unsafe HTML rendering exists. Application code
+  does not evaluate user-controlled JavaScript or Python. The generic generated
+  Pyodide loader contains an Emscripten dynamic-link branch that uses
+  JavaScript `eval`, but the shipped self-contained CPython/stdlib path does not
+  exercise it and loads under the CSP below without broad `'unsafe-eval'`.
 
-The PCRE2-enabled build needs a CSP equivalent to:
+The engine-enabled build needs a CSP equivalent to:
 
 ```text
 default-src 'self';
@@ -91,9 +107,11 @@ base-uri 'none';
 form-action 'none';
 ```
 
-The Toolbox shell currently requires inline styles. Corpus ZIP generation and
-PCRE2 use self-hosted modules and local workers under the existing
-`worker-src` policy. Broad `unsafe-eval` is not required.
+The Toolbox shell currently requires inline styles. Corpus ZIP generation,
+PCRE2, Pyodide and TeaVM use self-hosted modules/assets and local workers under
+the existing `worker-src` and `connect-src` policy. Broad `'unsafe-eval'` is not
+required; `'wasm-unsafe-eval'` remains required for the two WebAssembly
+runtimes.
 
 Report vulnerabilities privately to the repository owner before public issue
 details are posted.