fix(ffi): eliminate aliasing UB + add Azure Policy JSON compilation FFI (#727)

* fix(ffi): eliminate aliasing UB via to_shared_ref migration

Add to_shared_ref() helper that creates &T (shared reference) from raw
pointers instead of &mut T. This eliminates undefined behavior caused by
violating Rust's aliasing invariant when C# SafeHandle permits concurrent
FFI calls on the same handle.

With &mut T, the compiler may assume exclusive (noalias) access and
reorder or elide reads/writes — a miscompilation risk when another thread
holds a reference to the same object. Switching to &T removes that
assumption; actual mutation is mediated by the interior RwLock inside
Handle<T>, which is the sole synchronization mechanism.

Migrated sites:
- rvm.rs: 20 non-drop call sites
- engine.rs: 30 non-drop call sites + with_unwind_guard for timer fns
- compiled_policy.rs: 2 call sites
- Fix null-data UB in regorus_program_deserialize_binary

Drop paths retain to_ref() where exclusive access is guaranteed by the
caller contract (preventing use-after-free).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(ffi): add Azure Policy JSON compilation FFI and C# bindings

- AliasRegistry builder pattern: RegorusAliasRegistryBuilder (mutable,
  single-threaded) + RegorusAliasRegistry (immutable, Arc-wrapped)
- Azure Policy JSON compilation: regorus_compile_azure_policy_rule and
  regorus_compile_azure_policy_definition with alias registry support
- regorus_rvm_set_context for host-supplied ambient data
- C# AliasRegistryBuilder and AliasRegistry classes with convenience
  factories (FromJson, FromManifest, Empty)
- C# AzurePolicyCompiler static class for policy rule/definition compilation
- Compile functions take *const RegorusAliasRegistry (read-only via
  to_shared_ref for concurrent compilation safety)
- Fix pre-existing clippy warnings across multiple crates

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

bindings/csharp/Regorus/SafeHandles.cs

@@ -184,28 +184,48 @@ namespace Regorus
         }
     }
 
+    internal sealed class RegorusAliasRegistryBuilderHandle : SafeHandleZeroOrMinusOneIsInvalid
+    {
+        private RegorusAliasRegistryBuilderHandle() : base(ownsHandle: true)
+        {
+        }
+
+        internal static RegorusAliasRegistryBuilderHandle Create()
+        {
+            unsafe
+            {
+                var raw = Internal.API.regorus_alias_registry_builder_new();
+                if (raw is null)
+                {
+                    throw new InvalidOperationException("Failed to create Regorus alias registry builder.");
+                }
+
+                var handle = new RegorusAliasRegistryBuilderHandle();
+                handle.SetHandle((IntPtr)raw);
+                return handle;
+            }
+        }
+
+        protected override bool ReleaseHandle()
+        {
+            if (!IsInvalid)
+            {
+                unsafe
+                {
+                    Internal.API.regorus_alias_registry_builder_drop((Internal.RegorusAliasRegistryBuilder*)handle);
+                }
+                SetHandle(IntPtr.Zero);
+            }
+            return true;
+        }
+    }
+
     internal sealed class RegorusAliasRegistryHandle : SafeHandleZeroOrMinusOneIsInvalid
     {
         private RegorusAliasRegistryHandle() : base(ownsHandle: true)
         {
         }
 
-        internal static RegorusAliasRegistryHandle Create()
-        {
-            unsafe
-            {
-                var raw = Internal.API.regorus_alias_registry_new();
-                if (raw is null)
-                {
-                    throw new InvalidOperationException("Failed to create Regorus alias registry.");
-                }
-
-                var handle = new RegorusAliasRegistryHandle();
-                handle.SetHandle((IntPtr)raw);
-                return handle;
-            }
-        }
-
         internal static RegorusAliasRegistryHandle FromPointer(IntPtr pointer)
         {
             if (pointer == IntPtr.Zero)