fix(jq): enforce fancy-regex execution limits

[chaliy]

Motivation

• Mitigate a CPU DoS risk where untrusted jq regex patterns compiled with fancy-regex could run unbounded backtracking and exhaust worker time without being preemptible by the interpreter timeout.

Description

• Add DELEGATE_SIZE_LIMIT, DELEGATE_DFA_SIZE_LIMIT, and BACKTRACK_LIMIT constants to Flags and apply them in Flags::build via RegexBuilder calls delegate_size_limit, delegate_dfa_size_limit, and backtrack_limit to bound fancy-regex resource usage.
• Add a test-only helper Flags::build_with_backtrack_limit to construct regexes with an explicit low backtrack limit for unit testing.
• Add the unit test backtrack_limit_enforced which verifies a pathological pattern triggers a backtrack-limit error at runtime.
• All edits are contained in crates/bashkit/src/builtins/jq/regex_compat.rs and preserve the existing output shape and compatibility with jaq-std-based defs.

Testing

• Ran cargo test -p bashkit backtrack_limit_enforced --features jq and the new backtrack_limit_enforced test passed.
• The related sed fancy-regex backtrack test remained passing and a broader cargo test run for exercised targets completed without failures in this environment.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	3cbb7cb	Commit Preview URL	May 08 2026, 09:10 AM