Add production packaging and runtime operations for bundled NetEase rules

[jacklilyhello]

Motivation

• Make bundled NetEase + optional PCRE2 production-operable with clear opt-in packaging, conservative defaults, and operational diagnostics.
• Preserve existing default behavior: RE2 backend, CGO-free builds, disabled NetEase datasets, and unchanged root license and bundled data.
• Provide operator-facing deployment, config examples, validation commands, and safe observability for runtime bundled rules without exposing raw patterns or secrets.

Description

• Packaging: add multi-target Dockerfile with a default default (RE2/CGO-free) target and an opt-in pcre2 target that builds with CGO_ENABLED=1 -tags pcre2 and installs PCRE2 build/runtime bits only for the PCRE2 image, and add make docker-build, make docker-build-pcre2, make docker-smoke, and make docker-smoke-pcre2 targets.
• Runtime/diagnostics: add --validate-config and --print-bundled-summary flags to cmd/server to validate config and emit a safe bundled-runtime summary (and error clearly if regex_engine: pcre2 is selected but binary lacks PCRE2).
• Observability/config: extend bundled runtime stats to include selected regex_engine, regex_backend_available and a successful reload timestamp while continuing to avoid exposing raw regex patterns or offensive content, and add conservative config.bundled-rules.examples.yml snippets plus a docker-compose.pcre2.example.yml override.
• Documentation: add docs/production-runtime-ops.md, update README.md, CHANGELOG.md, and CODEX.md describing default RE2 path, opt-in PCRE2 tradeoffs, operational checks (make verify-bundled-netease, --validate-config, --print-bundled-summary), and GPL/MIT data boundary notes.

Testing

• Automated verification: ran gofmt, go test ./..., go vet ./..., go build ./..., CGO_ENABLED=0 go build ./..., make verify-bundled-netease, make fmt-check, make smoke, make e2e, make gosec (0 issues), and go run ./cmd/server --config config.example.yml --validate-config plus --print-bundled-summary, all of which completed successfully in the default RE2/CGO-free environment.
• PCRE2/tagged verification: attempted go test -tags pcre2 ./..., go build -tags pcre2 ./..., make test-pcre2, and make build-pcre2, which failed due to missing PCRE2 development files in the environment with the exact pkg-config error: Package 'libpcre2-8', required by 'virtual:world', not found (environment limitation, not code failure).
• Docker verification: Docker CLI is not available in this execution environment (/bin/bash: line 1: docker: command not found), so Docker image builds/smoke runs were not executed here but the Dockerfile multi-target and Makefile targets are added and documented with exact make/docker build commands for CI or operator use.
• Branch/PR state and failed checks: changes were committed on branch feature/production-packaging-runtime-ops (local HEAD b4231bbc839be93bca21bebf7bc18aa8538eff4b); attempting to push failed due to missing GitHub HTTPS credentials so no remote PR URL was created in this environment, and the only failed checks are environment-limited PCRE2 and Docker operations as noted above.

---

Codex Task