Migrate single-timeout ReDoS checks to scaling-ratio methodology across 37 languages #1071

Issue

The shared harness tests/extraction/languages/_strict_harness.py provides two ReDoS test methods:

1. assert_redos_immune (weak): Single payload, single 1.0s timeout. Can miss O(n²) backtracking that stays under 1.0s at the tested payload size.
2. _best_of_timing (strong): Geometric-growth scaling ratio across multiple payload sizes (4x increase per doubling). The signature of real O(n²) backtracking — mandated by how_to_add_a_language.md's Strict Testing Prompt, Step 4, item 5: "measure actual execution time at several geometrically increasing sizes... a roughly 4x increase per doubling is the signature of real O(n²) backtracking."

Current state: Only 8 of 45 languages use _best_of_timing (css, c, cpp, csharp, groovy, makefile, tcl, yacc). The other 37 rely solely on the weaker single-timeout check across 392 total assert_redos_immune calls.

This is a detection-strength gap: the 37 languages run risk of shipping undetected ReDoS vulnerabilities at scale, especially in rules with the "adjacent-quantifier-overlap" shape (Rule 14 in how_to_add_a_language.md) which can blow up dramatically faster than a generous single timeout would ever catch.

Solution

1. For each of the 37 languages currently using only assert_redos_immune:

   • Identify rules with adjacent-quantifier overlaps or nested/unbounded character classes (scan for patterns like *\*, +\+, [^\]]*, etc.)
   • Priority order: rules already flagged as Re DoS risks in epic Epic: Strict & exact regex test coverage for all structural signatures, per language #518 findings (e.g., the spec_exposure copy-paste bug class across 28 languages from issue spec_exposure's unbounded [^\]]* ReDoS is copy-pasted across 28 languages, including already-merged yacc #713).
   • Convert at least the top 3 most-complex rules per language from assert_redos_immune to _best_of_timing with pathological multi-size payloads.

2. Consult tests/extraction/languages/_strict_harness.py and existing c/cpp/csharp _strict.py usage for the method signature and expected test patterns.

Files to modify

All tests/extraction/languages/test_<lang>_strict.py files except: css, c, cpp, csharp, groovy, makefile, tcl, yacc (these 8 are already migrated).

Related issues

• Epic Epic: Harden the strict structural-signature test suite (non-extraction-pillar rules) per language #1069: Harden the strict structural-signature test suite (non-extraction-pillar rules) per language
• Issue spec_exposure's unbounded [^\]]* ReDoS is copy-pasted across 28 languages, including already-merged yacc #713: spec_exposure's unbounded [^]]* ReDoS is copy-pasted across 28 languages
• Epic Epic: Strict & exact regex test coverage for all structural signatures, per language #518: Strict & exact regex test coverage for all structural signatures, per language (CLOSED)