fix(security): remove regex timeout race

[Aaronontheweb]

Summary

• Replace scanner regex timeouts with the .NET non-backtracking engine.
• Keep every threat pattern unchanged.
• Remove wall-clock dependence from prompt-injection scans.
• Preserve linear work for untrusted input.

Cause

The Windows runner paused DiskDestructionRegex for longer than its one-second timeout.

The short test input did not cause excessive backtracking. The timeout measured scheduler delay and threw after the thread resumed.

Failure: https://github.com/netclaw-dev/netclaw/actions/runs/30855724493/job/91826160402

Validation

• dotnet test src/Netclaw.Security.Tests/Netclaw.Security.Tests.csproj -c Release --no-restore
• The exact failed test passed in 25 isolated processes.
• dotnet test Netclaw.slnx -c Release --no-restore
• dotnet slopwatch analyze
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify
• git diff --check

[Copilot]

Pull request overview

This pull request removes regex match timeouts from RegexPromptInjectionDetector and switches to the .NET non-backtracking engine. This change reduces false failures from scheduler delay and keeps linear-time regex work for untrusted input.

Changes:

• Replace per-pattern matchTimeoutMilliseconds usage with RegexOptions.NonBacktracking.
• Centralize regex options into shared constants for text and Unicode patterns.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.