feat: add multi-engine regex flavour support

scripts/package-release.test.ts

@@ -1,3 +1,5 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
 import { describe, expect, it } from "vitest";
 import {
   createDeterministicZip,
@@ -41,6 +43,45 @@ describe("release packaging", () => {
     ).toThrow("Credential-like");
   });
 
+  it("scans reStructuredText legal notices for local build paths", () => {
+    expect(() =>
+      createDeterministicZip([
+        {
+          name: "engines/python/NOTICE.cpython-bundled.rst",
+          data: Buffer.from("Built from /home/example/private/source"),
+        },
+      ]),
+    ).toThrow("Local absolute path");
+  });
+
+  it.each([
+    ["assets/leak.js", Buffer.from('const source = "/mnt/private/app.ts";')],
+    [
+      "engines/example/module.wasm",
+      Buffer.from("/home/private/build/runtime.c"),
+    ],
+    [
+      "engines/example/module.pdb",
+      Buffer.from("c:\\Users\\private\\source\\module.cs", "utf16le"),
+    ],
+  ])("scans JS, WebAssembly and PDB-like asset %s", (name, data) => {
+    expect(() => createDeterministicZip([{ name, data }])).toThrow(
+      "Local absolute path",
+    );
+  });
+
+  it("allows only the byte-exact upstream Perl and Ruby path-bearing assets", async () => {
+    for (const name of ["engines/perl/emperl.data", "engines/ruby/ruby.wasm"]) {
+      const data = await readFile(path.resolve("public", name));
+      expect(() => createDeterministicZip([{ name, data }])).not.toThrow();
+      expect(() =>
+        createDeterministicZip([
+          { name, data: Buffer.concat([data, Buffer.from("changed")]) },
+        ]),
+      ).toThrow("Local absolute path");
+    }
+  }, 30_000);
+
   it("requires an explicit force flag for exact-version replacement", () => {
     expect(parseReleaseArguments([])).toEqual({ force: false });
     expect(parseReleaseArguments(["--force"])).toEqual({ force: true });