feat(flags): add rules engine boundary (FFL-2837 PR1)

[btthomas]

Pull request stack

1. Plan PR (#1345)
2. PR1: Rules engine boundary (feat(flags): add rules engine boundary (FFL-2837 PR1) #1346) <- you are here
3. PR2: Dynamic offline evaluation (#1347)
4. PR3: Provider API and documentation (#1348)

This description uses Simplified Technical English. Technical names and API names do not change.

Summary

This PR adds the internal boundary for dynamic offline rule evaluation.

• It adds one adapter for the flagging-core rules engine.
• It converts SDK contexts to flat rules contexts.
• It preserves the difference between a missing targeting key and an empty targeting key.
• It clones and freezes the temporary rules configuration.
• It omits an invalid flag without removing valid sibling flags.
• It normalizes evaluator results and metadata.
• It rejects serialization when a configuration contains rules.
• It protects temporary lookup from reserved property names.
• It adds wire, adapter, validation, serialization, and reserved-name tests.
• It does not change FlagsClient or provider behavior.

Reason

The React Native SDK must not implement a second rules engine. The adapter keeps flagging-core details out of the SDK state machine. Tests can replace the adapter with a deterministic fake.

Upstream contract

The latest published flagging-core version is 2.0.2. It does not contain the protobuf rules wire from openfeature-js-client#344.

PR #344 will provide:

• FlagsConfiguration.rules.response
• The generated Protobuf-ES response type
• Independent branch and per-flag validation
• Evaluator result metadata
• Safe own-property lookup
• Serialization rejection for rules configurations

After publication, this PR must use the upstream parser and evaluator directly. It must not keep a local protobuf decoder or a second structural validator.

Temporary code

This PR contains eight TODO(FFL-2837) markers:

1. Remove the pending rules types, reader, and wire wrappers.
2. Remove the legacy JSON rules-wire parser.
3. Remove the local rules serialization guard.
4. Replace the legacy UFC response alias with the upstream rules.response type.
5. Define a bounded regular-expression policy.
6. Remove the legacy JSON clone and validator.
7. Remove the legacy result-metadata fallback.
8. Remove the local safe-lookup compatibility guard.

Keep the reserved-name tests after the upstream change. They are contract tests.

The fake rules engine is a permanent unit-test boundary. It is not temporary upstream code.

The new rules response does not contain extraLogging. That field is deprecated. This PR does not try to restore it.

User impact

There is no new user-visible behavior in this PR. Existing online and precomputed offline evaluation do not change.

Checks

• yarn tsc --noEmit -p packages/core/tsconfig.json
• Targeted ESLint for all changed TypeScript files
• 23 rules and wire tests
• 55 configuration tests
• 92 flags tests