v2026.7.21

Bindings, fortified — the binding surfaces are now guarded like the engine, and the crate publish is automated.

A post-audit hardening release (the engine is unchanged; this is CI, tests and docs):

• The crate publish is automated. release.yml now publishes the real-regex crate to crates.io after the
  wheels, gated on a crates-io environment and idempotent (a re-run of an already-published version is a
  no-op, not a failure). It was a manual step until now.
• A cross-platform bindings matrix. The C shim and the Rust crate are built and tested on macOS (ARM) and
  Windows (MSVC), not only Linux — a platform issue in the C ABI (the kind of MSVC deprecation that surfaced
  during the hotfix) is now caught in CI, not by a user.
• The C ABI surface is netted. The shim runs under ASan/UBSan and is fuzzed (fuzz-capi), and its coverage
  is visible; the coverage floor measures the engine's reachable logic, with the shim's unreachable
  FFI-safety catch-alls guarded by the sanitizers and fuzzer instead.
• The perimeters are written. SECURITY.md documents the three published surfaces and the fallback nuance;
  MISRA.md documents that the C ABI shim is a scoped, assumed deviation; the CMake position (bindings/c is
  source-only) is decided and recorded.

Small engine hygiene rides along (a documented hot-path function, a redundant parallel vector removed).