feat: add multi-engine regex flavour support

CHANGELOG.md

@@ -2,6 +2,69 @@
 
 ## Unreleased
 
+## 0.4.0 — 2026-07-27
+
+- Expand the workbench from four to twelve selectable execution profiles:
+  JavaScript/ECMAScript, standalone PCRE2, PHP, Perl, Python, Ruby, Java, C++,
+  Go, Rust, .NET and Scala/JVM compatibility.
+- Add actual PHP 8.5.8 `preg_*` execution through the self-hosted
+  `@php-wasm/web-8-5` 3.1.46 runtime. Preserve native UTF-8 byte ranges and
+  identify PHP's embedded PCRE2 as 10.44, independently of the standalone
+  PCRE2 10.47 pack.
+- Add actual Perl 5.28.1 execution through unmodified WebPerl 0.09-beta assets
+  as an explicitly legacy beta profile. Pass user values through a fixed
+  data-only JSON request, stream pre-tokenized bounded replacement output into
+  a separately verified MEMFS binary file, disable runtime regex evaluation,
+  reject code assertions and retain the upstream loader's dormant
+  interoperability `eval` site as a documented CSP caveat.
+- Add actual CRuby 4.0.0 `Regexp` execution through a minimal ruby.wasm
+  2.9.3-2.9.4 pack. Native `String#gsub`/`String#sub` block iteration drives a
+  fixed byte-bounded CRuby-compatible replacement expander. Use separate
+  worker-local WASI request/output files and metadata-only inert JSON instead
+  of output escaping or ruby.wasm's JavaScript-eval object conversion; reject
+  lossy lone-surrogate requests and pass the strict-CSP browser gate.
+- Add Emscripten 6.0.4 libc++ `std::wregex` execution with the modified
+  ECMAScript default grammar, alternate standard grammars and a build
+  configured with dynamic execution disabled. Stream a fixed bounded
+  replacement formatter through the byte cap and verify its grammar against
+  libc++ at load.
+- Add Go 1.26.5 standard-library `regexp` and Rust `regex` crate 1.13.1
+  execution, preserving their native UTF-8 byte ranges and non-backtracking
+  semantics. Use bounded streaming replacement expanders that are
+  differentially checked against `Regexp.ExpandString` and
+  `Captures::expand`, with predictable base64 output transport. Measure exact
+  encoded request bytes and reserve native JSON limits for worst-case escaping
+  so control-heavy inputs retain the documented decoded limits.
+- Add .NET 10.0.10 `System.Text.RegularExpressions` in browser WebAssembly,
+  with invariant-culture execution, native UTF-16 ranges and a bounded native
+  regex timeout inside the killable worker. Stream bounded replacement tokens
+  without materializing `Match.Result`, verify token semantics against native
+  .NET at load, and transport output as bounded base64-encoded UTF-8.
+- Add an explicitly labelled Scala/JVM compatibility profile backed by the
+  verified TeaVM 0.15.0 `java.util.regex` engine. No Scala runtime, Scala
+  wrapper API or OpenJDK runtime is claimed.
+- Add partial application-owned lexical syntax and replacement providers,
+  flavour-specific quick-reference content and capability labels for the eight
+  new profiles while keeping each real runtime authoritative.
+- Add deterministic, closed-file-set runtime packs, checksums, licences,
+  notices, exact toolchain/source identities and release verification for the
+  new self-hosted engines.
+- Close the existing Pyodide pack's full base-runtime provenance: exact
+  primary archive or Git tree identities, vendored JavaScript-port hashes,
+  CPython/Emscripten patch and recipe hashes, a preferred-form HACL* route,
+  independently anchored notices, and executable identity checks for the
+  linked compression/database/parser components.
+- Transport bounded Python replacement output as canonical base64 with strict
+  declared-length, request-cap and UTF-8 validation instead of
+  content-dependent JSON escaping.
+- Close the PHP pack's complete native/source/legal inventory with exact
+  package, binary, build-recipe, archive and Git identities; independently
+  pin 38 legal assets; audit linked component versions; and explicitly exclude
+  the GMP, libsodium, tidy, ICU/intl, FreeType, ImageMagick and adjacent AOM
+  false-positive or unshipped detections.
+- Bound retained heavyweight workers with least-recently-used eviction so
+  selecting many profiles does not leave every runtime resident.
+
 ## 0.3.0 — 2026-07-27
 
 - Add a self-hosted Pyodide 314.0.3 worker containing CPython 3.14.2 `re`, with