feat(judge): add output_matches rule

[googs1025]

Summary

Add output_matches support to the deterministic rule_based judge so eval authors can assert final output with Go regular expressions without changing output_contains literal
matching semantics.

Related issues

Closes #165

Changes

• Add output_matches rule schema with all, any, and not groups.
• Validate configured regex patterns during config validation.
• Evaluate output_matches against the final message in RuleBasedJudge.
• Preserve existing failure-priority and success-all-pass semantics.
• Add unit coverage for regex matching, empty groups, failure rules, and invalid regex validation.
• Update user-facing and Skill author docs.

Test plan

• make test passes
• make verify passes (fmt + vet + lint)
• Manual testing steps (if applicable): N/A

Notes for reviewers

output_contains remains literal substring matching. Tool-set aliases and output section checks from the original issue are intentionally deferred.

[zpzjzj]

Code review summary

• 🟠 Major: 1
• 🔴 Blocker: 0

The implementation scope and the normal all / any / not paths look consistent with #165. One reproducible edge-case bug remains in output_matches.not: an empty Go regex is mistaken for the no-match sentinel. I left the details inline.

Overall: conditionally ready after the Major finding is fixed.

---

Manual source review and focused reproduction @ 13edd02ea043d0379d2cbc4e2d35d7be9b18536a; 1 finding accepted, 0 downgraded, 0 rejected. The configured local automated reviewer was unavailable.

[zpzjzj]

LGTM