RE2-unsafe regex patterns: audit production segments and decide fallback policy

[khvn26]

The translator returns None for any REGEX condition whose pattern contains:

• Backreferences (\1–\9)
• Lookarounds ((?=, (?!, (?<=, (?<!)

Snowflake uses RE2, which doesn't support either feature. The detection is conservative-syntactic in _RE2_UNSAFE (src/flagsmith_sql_flag_engine/translator.py).

The engine-test-data suite doesn't include any RE2-unsafe patterns, currently.

What to do

1. Audit production segment definitions for either pattern — REGEXP_LIKE over the segments table's rules JSON column with a pattern that catches \1–\9 or (?=/(?!/(?<=/(?<! as substrings. Cheap query, gives a real prevalence number.
2. Decide fallback policy based on prevalence:
   • If essentially nobody uses these features (most likely): surface the error at segment-edit time. The Flagsmith UI rejects the pattern with a clear "Snowflake-backed envs do not support backreferences / lookarounds" message. Translator's None return becomes an unreachable defensive branch.
   • If non-trivial usage: ship a fallback that runs the pattern through the Python flag_engine just for those segments, e.g. by calling out to an is_in_segment UDF. Adds back the per-row Python tax but only for the affected segments.

[sentry]

Sentry Issue: FLAGSMITH-API-68K