Fix unsound regex fast path, output path collisions, and drop-sink validation

[eitamring]

Three fixes from a pre-release audit. No performance changes.

• The regex fast path turned fully-literal patterns into substring checks, dropping anchors and word boundaries: ^PING$ matched any line containing PING and could shadow later rules. The fast path now skips any pattern with a zero-width assertion. Regression tests plus a parity fuzz against plain regexp (1.3M execs).
  vet, test, and race pass; the 1M-line demo output is byte-identical to main.