Seven reports from @takahashim, and v0.0.27

Seven more issues from @takahashim, from a regex that never finished compiling to an abort flag that slowed every instruction, are fixed, and v0.0.27 adds a Brotli copy of every WebAssembly engine.

@takahashim, whose ten reports shaped v0.0.25, sent seven more after v0.0.26, each with a minimal repro and most with a pointer to the cause. Nested quantified groups such as (?:(?:a|)+|)+ made the regex optimizer copy every level below each loop it unrolled: depth 20 took 1.6 s to compile, depth 31 never finished, and from depth 17 a 16-bit loop counter overflowed and panicked the safe-sandbox engine (#58). Unrolling now has a per-regex budget and the compiled-size cap is checked while the program is emitted, so depth 31 compiles in about a millisecond (54906ffe). Alternation is built as a shallow tree that keeps its alternatives' order, so the safe-sandbox profile no longer stops at 64 of them and 200,000 compile on a 1 MiB stack (#57, 351a1912). In a large function a statement outside a loop gives its scratch registers back, so a bundle of more than about 33,000 statements compiles (#56, 9356ecb2).

An installed abort flag had sent every instruction down the full metering path, about seven times slower; it is now read on its own stride from the countdown, and an abort still lands within 4,096 instructions (#62, ed40ce85). Native safe-sandbox builds have SharedArrayBuffer and Atomics again, backed by agent-local bytes, while the WebAssembly engines keep a guest surface with no shared-memory globals (#61, ec67592e, 7682df51, 05d2bd9b); the writing Atomics operations revalidate the access after converting their value (#59), and super() into %TypedArray% throws (#60). Every WebAssembly engine is now also published as a Brotli .wasm.br, which the embed kit's loader 1.2.0 reads however it is served (81329040). v0.0.27 was published on 18 October from 74d92e70.