[WAF-02] Bootstrap the MIT Zig 0.17 Pantry workspace

[chrisbbreuer]

Objective

Create library, CLI, daemon, C ABI, UI workspace, Zig 0.17 Pantry manifest and lock, MIT licensing, target matrix, and no-submodule enforcement.

Deliverables

• Implement the complete scoped behavior described above.
• Keep request-path work independent from UI, PostgreSQL, and blocking audit I/O.
• Use Zig 0.17-dev and dependencies pinned through Pantry; do not add Git submodules.
• Keep public APIs explicit about ownership, resource limits, errors, security policy, and compatibility.
• Add focused unit, integration, differential, fuzz, benchmark, and documentation coverage as applicable.

Acceptance criteria

• The scoped implementation and tests are merged on main in small conventional commits.
• Zig formatting, focused tests, and the relevant CI suite pass.
• Compatibility claims have executable evidence and no unexplained skips or silent fallbacks.
• Untrusted inputs have deterministic bounds; hot paths have benchmark evidence.
• Documentation and the machine-readable compatibility matrix are updated.

Relationships

• Parent: WAF-00

Blocked by

None

Blocks

• WAF-03
• WAF-04
• WAF-05
• WAF-50
• WAF-60

Baselines

• ModSecurity 3.0.16
• Coraza 3.7.0
• OWASP CRS 4.28.0
• libinjection 4.0.0
• Zig 0.17-dev resolved and locked through Pantry

[chrisbbreuer]

Bootstrap slice shipped in 91d62c1: Zig 0.17/Pantry lock, PostgreSQL 18 and native libpq 18 profile, library/CLI/daemon, CI-pinned sibling repositories, STX/header workspaces, target matrix, MIT/security docs, and no-submodule enforcement. CI passed: https://github.com/zig-utils/zig-waf/actions/runs/29893177265. This stays open until the initial C ABI artifact is added.

[chrisbbreuer]

Completed by 91d62c1, aec23b4, and 09b5b96. The workspace now ships the library, CLI, daemon, installed static C ABI/header, C-host smoke test, STX workspace, exact Zig/Pantry lock, PostgreSQL/native libpq profile, target matrix, executable compatibility evidence, CI-pinned sibling checkouts, and no-submodule enforcement. Latest CI passed: https://github.com/zig-utils/zig-waf/actions/runs/29893842701