Add optional PCRE2 CI coverage

[jacklilyhello]

Motivation

• Provide an isolated, optional CI workflow to exercise the Phase D PCRE2-backed code paths without changing default CI or requiring PCRE2 for default CGO-free builds.
• Fix failing PCRE2 backreference tests so native PCRE2-tagged builds exercise lookaround and backreference support correctly.
• Add runtime and configuration plumbing so bundled NetEase rules can report PCRE2 compatibility and optional activation behind an explicit pcre2 engine selection.

Description

• Add a new optional GitHub Actions workflow at .github/workflows/pcre2.yml that runs on push and pull_request, installs pkg-config and libpcre2-dev, and executes make test-pcre2 and make build-pcre2 under the job name PCRE2 / Optional tagged build.
• Introduce a PCRE2 matcher implementation and stub plus a small regex-backend abstraction (internal/matcher/regex_backend.go, internal/matcher/pcre2.go, internal/matcher/pcre2_stub.go), and adapt the regex matcher to compile rules with a selectable engine (re2 or pcre2).
• Extend bundled runtime handling to record selected regex_engine, backend-unavailable skipped counts, PCRE2-compatible/incompatible counts, and implement effectiveRegexEngine and pcre2Compatible helpers in internal/bundled/runtime.go so PCRE2 activation is optional and does not affect default RE2 behavior.
• Fix PCRE2 backreference test patterns (internal/matcher/pcre2_test.go and internal/engine/bundled_runtime_test.go) and add a PCRE2-tagged bundled runtime test (internal/engine/bundled_runtime_pcre2_test.go) that validates activation and runtime stats when built/ran with -tags pcre2.
• Add Makefile targets test-pcre2 and build-pcre2, update config/defaults/docs (config.example.yml, docs/bundled-rules-phase-b-runtime.md, CODEX.md, README.md, CHANGELOG.md) to document the optional PCRE2 engine and the developer log entry describing this follow-up.

Testing

• Ran go test ./... which completed successfully for the repository packages.
• Ran go vet ./... which completed successfully with no reported issues.
• Ran go build ./... and CGO_ENABLED=0 go build ./... which both succeeded.
• Ran make verify-bundled-netease, make fmt-check, make smoke, and make e2e which all returned successfully.
• Ran make gosec which completed and reported zero blocking issues in the current baseline.
• Installed local PCRE2 dev packages and ran PCRE2-tagged verification with go test -tags pcre2 ./..., go build -tags pcre2 ./..., make test-pcre2, and make build-pcre2, and all PCRE2-tagged tests and builds passed in the local environment after the test fixes were applied.

---

Codex Task