engine: wire -regex captures into gated -exec {0}..{N}

[helly25]

Summary

Completes capture-aware -exec (#50). A -regex/-iregex match now records its capture groups, and a gated -exec substitutes them as {0}..{N}:

xff --exec-fields . -regex '.*/(.*)\.(.*)' -exec mv {} {1}.bak.{2} \;

• EvalContext gains a per-entry captures store.
• MatchesRegex fills it on a match (via FullMatchCaptures): {0} whole match, {1}..{N} the groups.
• The gated -exec passes ctx.captures on the RenderContext, so fields' {0}..{N} placeholders resolve.
• The store is active only under --exec-fields (null otherwise), so the default -regex path stays a plain boolean match with no capture allocation — and default -exec is unchanged.

This closes the #51→#50 arc: the named-field vocabulary and regex captures are both available in -exec, opt-in.

Test plan

• evaluate_test.ExecFieldsSubstitutesRegexCaptures: a per-Match capture store; {1} resolves to group 1 only under the gate (exit-code check), literal without it.
• run_test.ExecFieldsSubstitutesRegexCaptures: end-to-end --exec-fields . -regex '.*/(a)\.(txt)' -exec … "{1}.{2}" > "{path}.cap" \; → marker contains a.txt.
• Green on both toolchains: bazel test //... (default) and --config=clang --config=asan.