fix: regexes with a linear pattern over trusted input carry no wall-clock match timeout

[Blind-Striker]

Regexes whose pattern matches in linear time over trusted input no longer carry a wall-clock match timeout; the four that can backtrack quadratically keep theirs, with the reason beside each. The rule goes into the coding style. Generated output is unchanged.

Closes #427.

Why

.NET's regex match timeout is wall-clock: on a descheduled thread it fails a match that needs microseconds. #426 showed this on a stalled macOS merge-group runner and ejected an unrelated PR, and #428 removed the timeout from eleven test-side regexes. This PR covers the rest.

What changes

• Tool-side (5): SnapshotStateReader's full-SHA check, SourceWatchLoader's SHA-256 check, and SnapshotMarkdownRenderer's identity-table, pin-prose and date-line patterns move to Timeout.Infinite.
  • Inputs: spec/SNAPSHOT.md, spec/source-watch.json, git rev-parse output and a maintainer-selected receipt.
  • Why it's safe: the hashes match a fixed width; the renderer's runs are delimiter-separated (one pattern is unanchored), so it scans linearly.
• Test-side (14): 13 Tools.Tests regexes plus DriveManifestTests move to Timeout.Infinite, or to Regex.InfiniteMatchTimeout where the API takes a TimeSpan. PackedReadmeTests' timeout field goes with its only use.
  • Inputs: repository files, packed test outputs and test constants.
  • Evidence: each one was audited structurally and its caller traced; see below.
• Kept (4): these can backtrack quadratically on adversarial text, so each keeps its finite timeout, with the reason in a comment:
  • AnalyzerConfigReader's property line, where a lazy value and a trailing whitespace run overlap;
  • the comment scan's documentation-path rule, whose path class also matches docs/;
  • its Stryker marker, where each unanchored start retries a line that can't reach $;
  • CommentReader's PowerShell block, where each unclosed <# scans to the end.
• Canon (docs/engineering/coding-style.md §3): a regex whose pattern matches in linear time over repository-pinned or test-local input passes Timeout.Infinite, or Regex.InfiniteMatchTimeout where the API takes a TimeSpan. One over untrusted input, or one whose pattern can backtrack superlinearly, keeps a finite timeout with its reason beside it. This records the decision UpstreamClientContract's route regex times out on loaded runners and can eject any PR #426 and test: regexes over pinned and in-test input carry no wall-clock match timeout (#426) #428 already took, so that a new regex doesn't reintroduce the flake.
• Out of scope: the SDK's generated 100 ms key-regex reads untrusted runtime input, and it stays as it is (protocol-and-generation.md).

Evidence

• The audit: every changed pattern was checked for linearity on any input, meaning no nested quantifier, no quantified group whose alternatives overlap, and no backreference under a quantifier. Each caller was traced to its input. The four kept patterns each have a concrete quadratic input. Only the timeout argument changes; every pattern and every option is untouched.
• A search across tools/, tests/ and src/ found no other finite regex timeout over trusted input.
• Covering tests: the existing classes cover every changed regex, so there are no new rows. A timeout argument's removal has no deterministic behaviour to test, so there is no mutation row.

Local check and review

• Local check on dev-01, after a root Release build: slopwatch 0 issues; 0 warnings; both format passes; verify-clones passing; generate --verify current; the whole Tools.Tests project at 2086/0, Packaging included; DriveManifestTests 3/3 on net10.0 and net11.0. CI is the full gate.
• A miss caught by the gate: the first draft of the Stryker reason comment quoted the marker's own text. The repository's comment-residue guard flagged it, and the reworded comment passes.
• Process:
  • The tool-side edit is a coordinator hand edit: six one-token changes, cheaper than a dispatch.
  • A fresh cross-family review (Sol) found the 13 extra test-side sites and corrected the original rationale. The renderer has an unanchored pattern, and one caller reads a maintainer-selected receipt; neither changes the decision.
  • A Sol audit task then classified all 17 test sites. Its edits stopped on a scope question (removing the unused field), so the coordinator applied the audited verdicts.

Provenance: Generator lane, coordinated and finished in Claude Code; review and audit on the opencode dispatch harness (openai/gpt-6.1-sol-fast-1m).

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}