feat(#130): on_result expression: matcher + matches regex operator

[AlexChesser]

Closes part of #130 — the consumption half (how users gate on a signal). The production half (capturing logprobs/confidence from native runners) is deliberately deferred until the native LLM runner (#128) lands with tool support.

Summary

Decouples two concerns that #130 conflated:

1. Producing a confidence signal — runner-specific, requires wire-format support (blocked on Design & implement native LLM provider support (§21) #128). Claude CLI and Codex CLI don't expose logprobs at all; only a native HTTP-based runner can.
2. Consuming a signal to gate flow — a generic matcher usable today for exit codes, stdout/stderr checks, cross-step conditions, and eventually confidence scores once producers exist.

This PR ships (2). When (1) lands, expression: "{{ step.x.confidence }} >= 0.75" drops in without further spec or grammar work on on_result.

What's new

• §5.4 expression: matcher — arbitrary §12.2 condition against any template variable in the turn log. Unlocks branching on stdout/stderr (which contains: can't reach on context steps), specific exit codes beyond 0/any, and cross-step references.
• §5.4 matches: /PAT/FLAGS named matcher — regex shorthand for the response.
• §12.2 matches operator — regex comparison, shared with condition: so the two grammars cannot drift.
• §12.3 Regex Syntax — single source of truth for /PAT/FLAGS. Flags i/m/s accepted. g rejected at parse time with a specific diagnostic (boolean matching — "global" is meaningless). Other Perl flags rejected; guidance points at inline (?x) for verbose.

Design choices worth flagging

• Regex compiled at parse time. Malformed patterns fail pipeline load, not match time. A regex sitting dormant in on_result for months can't surprise you at 3am when a specific response finally triggers it.
• Condition drops PartialEq. regex::Regex has no PartialEq; the one existing assert_eq! on Option<Condition> was rewritten as a matches! pattern. No production code compared Condition values for equality.
• ResultMatcher::Expression { source, condition } — the source field preserves the original literal for materialize round-trips and diagnostics. condition reuses the full Condition union, so comparison and regex forms go through one evaluator.
• Named matches: desugars at parse time into the expression form. Runtime has exactly one regex evaluation path.
• evaluate_on_result signature change — now takes &Session and returns Result<Option<ResultAction>, AilError>. Unresolvable template in an expression: LHS aborts via CONDITION_INVALID, matching the §11 template-resolution contract. No silent-non-match fallback.
• g flag rejected with a specific error, not silently ignored. Half the web has muscle memory for /foo/gi; silently dropping it would let patterns look like they mean something.
• Unanchored, case-sensitive by default. /PASS/ matches "tests PASSED". Matches JavaScript/Perl/Ruby convention rather than inventing a different default. (?i) or /foo/i for case-insensitive.

Deliberately out of scope

• DoWhile::exit_when stays ConditionExpr — no regex support in loop exits yet. Widening it to the full Condition union needs its own validation rules (exit_when rejects Always/Never) and is a separate follow-up.
• Numeric operators (<, <=, >, >=) and boolean combinators (&&, ||). The spec's planned-extensions block flags these as the joint §12.2 + §5.4 extension that unlocks confidence-score gating once native runners surface the signals.
• Logprobs / confidence signals themselves — blocked on Design & implement native LLM provider support (§21) #128 native LLM runner with tool support.

Test plan

• 911 tests pass (419 lib + 492 integration)
• New regex literal parser: 20 unit tests (valid literals, i/m/s flags, embedded slashes, \/ escaping, g rejection, invalid patterns, empty-pattern guard)
• Condition::Regex evaluation: 4 new unit tests
• §12.2 matches integration tests: basic, case-sensitivity defaults, i flag, full parser path, invalid regex → parse failure, g-flag rejection
• §5.4 matcher integration tests: expression: on stderr, named matches: shorthand, expression: with matches operator, unresolvable template aborts, parse-time multi-matcher rejection
• cargo clippy — zero new warnings introduced (29 pre-existing errors in unrelated files unchanged)
• cargo fmt --check clean

Commit history on the branch

Commit	Type	Change
a434577	spec	§5.4 expression: matcher
0c4e660	spec	§12.2 matches operator
17450dd	spec	/PATTERN/FLAGS regex-literal syntax
0086ac5	spec	§12.3 regex spec as single source of truth
e1e1540	feat	Full implementation

https://claude.ai/code/session_01GX2TW85n2yzAyTZ8TyM1Wj