feat: add multi-engine regex flavour support

SOURCE.md

@@ -1,10 +1,10 @@
 # Source identity
 
 - Project: Regex Tools
-- Release version: `0.3.0`
-- Release tag: `v0.3.0`
+- Release version: `0.4.0`
+- Release tag: `v0.4.0`
 - Repository: <https://git.add-ideas.de/zemion/regex-tools>
-- Previous release tag: `v0.2.0`
+- Previous release tag: `v0.3.0`
 - Licence: GPL-3.0-or-later
 - Copyright: © 2026 Albrecht Degering
 
@@ -28,18 +28,67 @@ The engine-pack inputs and rebuild gates are documented in
 - The Python pack is copied from the exact pinned Pyodide 314.0.3 npm package
   and contains its CPython 3.14.2 runtime, Python standard library, loader,
   WebAssembly module, metadata, checksums and licence material.
+  `SOURCE-MANIFEST.json` closes the base-runtime inventory with exact archive
+  hashes or Git commit/tree identities for Pyodide, pyodide-build, the
+  vendored Error Stack Parser and StackFrame ports, CPython, libffi, Hiwire,
+  liblzma, Zstandard, SQLite, bzip2, zlib, Emscripten and HACL*. It also pins
+  every Pyodide CPython/Emscripten patch and build recipe, documents the one
+  Regex Tools loader transformation, and maps each linked component to
+  independently anchored legal text.
 - The Java bridge source is under `engines/java/`. Its bundled module is
   compiled against TeaVM 0.15.0's `java.util.regex` class library and is
   identified as TeaVM rather than OpenJDK.
+- The PHP bridge source is under `engines/php/`. The runtime pack comes from
+  the pinned `@php-wasm/web-8-5` and support packages at 3.1.46, executes PHP
+  8.5.8, and reports its embedded PCRE2 as 10.44. This identity is separate
+  from the standalone PCRE2 10.47 pack. Its `native-components.json` binds the
+  exact WebAssembly to the WordPress Playground/PHP/Emscripten commits,
+  inventories all 32 linked native/source surfaces, records exact archive or
+  Git routes and explicitly bounds the upstream recipe's one unpinned
+  Oniguruma clone. Every linked component maps to independently pinned legal
+  text; runtime and binary audits distinguish GMP, libsodium, tidy, ICU/intl,
+  FreeType, ImageMagick and the adjacent AOM 3.13.1 recipe from what is
+  actually linked.
+- The Perl bridge source is under `engines/perl/`. The byte-for-byte WebPerl
+  0.09-beta prebuilt archive contains Perl 5.28.1 and Emscripten 1.38.28
+  output. It is shipped only as a visibly legacy beta target; user values cross
+  a fixed data-only bridge.
+- The Ruby pack comes from the pinned minimal `@ruby/4.0-wasm-wasi` and
+  `@ruby/wasm-wasi` packages at 2.9.3-2.9.4 and executes CRuby 4.0.0. The
+  application bridge under `engines/ruby/` uses bounded length-prefixed
+  worker-local WASI file input and inert JSON output instead of ruby.wasm's
+  JavaScript-eval object-conversion path.
+- The C++ bridge source is under `engines/cpp/`. Emscripten 6.0.4 compiles it
+  against libc++ `std::wregex` with dynamic JavaScript execution disabled. Its
+  `SOURCE-MANIFEST.json` pins the Emscripten, emsdk and LLVM identities and
+  maps the exact traced musl, emmalloc, compiler-rt, libc++ and libc++abi link
+  inputs to preferred-source paths and legal files. libunwind is retained as
+  an explicit audited exclusion because the selected JavaScript-exception
+  build links no `libunwind.a` member.
+- The Go bridge source is under `engines/go/`. The official Go 1.26.5
+  linux/amd64 distribution cross-compiles standard-library `regexp` for
+  `js/wasm`.
+- The Rust bridge source and exact Cargo lock are under `engines/rust/`.
+  rustc 1.97.1 and wasm-bindgen 0.2.126 compile `regex` crate 1.13.1 for
+  `wasm32-unknown-unknown`.
+- The .NET bridge source is under `engines/dotnet/`. .NET SDK 10.0.302 with
+  runtime 10.0.10 and its `wasm-tools` workload publishes the
+  `System.Text.RegularExpressions` browser-WASM pack.
+- Scala compatibility has no additional engine pack. It deliberately uses the
+  verified TeaVM Java pack and labels that shared runtime in every result.
 
 Generated staging is ignored. Only verified runtime packs with deterministic
 metadata, closed file sets, checksums and exact licence/notice material are
 installed under `public/engines/` and included in the application source and
 build.
 
-The v0.3.0 release includes native browser ECMAScript, PCRE2 10.47, CPython
-3.14.2 `re` through Pyodide 314.0.3 and TeaVM 0.15.0 `java.util.regex`. Go,
-Rust, .NET and legacy PCRE remain unimplemented. Earlier releases remain
-available under their historical tags and artifact coordinates. A future
-public artifact must bump package, manifest, tag and source identity together;
-it must not reuse `v0.3.0`.
+The v0.4.0 release includes native browser ECMAScript, standalone PCRE2 10.47,
+PHP 8.5.8 `preg` with PCRE2 10.44, legacy Perl 5.28.1 via WebPerl 0.09-beta,
+CPython 3.14.2 `re`, CRuby 4.0.0 `Regexp`, TeaVM 0.15.0 `java.util.regex`,
+Emscripten 6.0.4 libc++ `std::wregex`, Go 1.26.5 `regexp`, Rust `regex` 1.13.1,
+.NET 10.0.10 `System.Text.RegularExpressions`, and the explicitly shared
+TeaVM-backed Scala/JVM compatibility profile.
+
+Earlier releases remain available under their historical tags and artifact
+coordinates. A future public artifact must bump package, manifest, tag and
+source identity together; it must not reuse `v0.4.0`.