feat: add multi-engine regex flavour support

docs/PORTAL_REQUIREMENTS.md

@@ -1,31 +1,46 @@
 # Portal requirements
 
-Regex Tools is a static nested-path-safe application.
+Regex Tools is a static nested-path-safe application. All engine resources are
+self-hosted below the mounted release path; no runtime CDN fallback is allowed.
 
 Required delivery behavior:
 
-- JavaScript workers use a JavaScript MIME type.
-- `toolbox-app.json`, HTML and legal/source documents should remain
-  revalidation/no-cache resources.
-- Hashed Vite assets may use immutable long-term caching.
-- CSP must allow `worker-src 'self' blob:`.
-- `engines/pcre2/pcre2.wasm` and
-  `engines/python/pyodide.asm.wasm` must use `application/wasm`.
-- Engine `.mjs` files must use a JavaScript MIME type;
-  `engines/python/python_stdlib.zip`, JSON, licence, notice and checksum files
-  must be delivered without content transformation.
-- `script-src` must permit self-hosted WebAssembly compilation, normally with
-  `'wasm-unsafe-eval'`; broad `'unsafe-eval'` is neither needed nor recommended.
-- `connect-src 'self'` must allow the Pyodide worker to fetch its own
-  same-origin WebAssembly, standard-library and lock files.
-- Every file below `engines/pcre2/`, `engines/python/` and `engines/java/`
-  should use revalidation or a release-scoped immutable cache. These are not
-  content-hashed filenames and must never drift under one release identity.
+- JavaScript, module and worker files (`.js` and `.mjs`) use a JavaScript MIME
+  type.
+- Every `.wasm` file below `engines/` uses `application/wasm`. This includes
+  standalone PCRE2, PHP, Perl, Python, Ruby, C++, Go, Rust and every .NET
+  `_framework` WebAssembly file.
+- `toolbox-app.json`, HTML and legal/source documents remain
+  revalidation/no-cache resources. Hashed Vite assets may use immutable
+  long-term caching.
+- CSP permits `worker-src 'self' blob:`. The legacy Perl profile starts one
+  nested same-origin classic worker inside its supervised module worker.
+- CSP permits self-hosted WebAssembly compilation in `script-src`, normally
+  through `'wasm-unsafe-eval'`. Broad `'unsafe-eval'` must not be enabled to
+  accommodate a runtime. Ruby cold startup and the fixed legacy Perl path pass
+  the release's strict-CSP browser gate without broad eval. WebPerl retains a
+  dormant optional interoperability `eval` site in upstream `emperl.js`, but
+  the fixed bridge does not load it.
+- `connect-src 'self'` permits workers/runtimes to fetch their own same-origin
+  WebAssembly, Python standard-library, Perl data, .NET framework and metadata
+  resources.
+- Binary/data assets such as `python_stdlib.zip`, `emperl.data`, metadata JSON,
+  checksum files, licences and notices are delivered without content
+  transformation.
+- Range support is not required, but servers and proxies must not rewrite
+  engine bytes or apply HTML fallbacks to missing asset paths.
+- Every directory below `engines/` uses revalidation or a release-scoped
+  immutable cache. Most engine filenames are not content-addressed and must
+  never drift under one release identity.
+
+A suitable CSP is documented in [`SECURITY.md`](SECURITY.md). Deployments
+should test both a direct root mount and a nested mount such as
+`/apps/regex/`, including cold loading of all twelve profiles.
 
 The Portal must consume the immutable release ZIP, verify its SHA-256, verify
-manifest ID `de.add-ideas.regex-tools` and version `0.3.0`, and mount it at a
+manifest ID `de.add-ideas.regex-tools` and version `0.4.0`, and mount it at a
 relative target such as `apps/regex/`.
 
-The package, manifest, tag, artifact URL and checksum must all use the v0.3.0
+The package, manifest, tag, artifact URL and checksum must all use the v0.4.0
 identity. Historical artifact coordinates remain immutable and must not be
 overwritten or reused.