Grow the delete-handling deque in tre_tnfa_run_approx() dynamically

[kevinushey]

These pull requests were generated with Claude Code, but were reviewed by me (@kevinushey) before posting. I'll respond personally to any feedback; please let me know if this is okay.

---

This makes the delete-handling deque in tre_tnfa_run_approx() grow dynamically, addressing the existing /* XXX - dynamic ringbuffer size */ note.

Problem. The deque lives in a fixed 512-pointer array on the C stack, guarded only by assert(). A TNFA with more than 512 states reachable at one position overflows it. Worse, the initial fill loop does not wrap, so deque_end walks past the array without ever equaling deque_start — the assertion can never fire there, even in debug builds, and the overflow writes through the enclosing stack frame.

An alternation of ~200 distinct short literals is enough:

/* pattern: x000|x001|...|x199 */
tre_regaexec(&re, "zx59z", &match, params, 0);

PATCHED   k=200 rc=0 cost=1    (also k=400, k=800)
UNPATCHED k=200 Segmentation fault

(observed on Windows x64, mingw-w64 gcc 14; the crash threshold depends on platform and optimization level)

Approach. Start with a 256-entry array on the stack; when the initial enqueue of reachable states fills it, move to the heap with xmalloc/xrealloc, growing by 512 entries at a time. The circular enqueue in the later propagation loop keeps its existing assert() backstop, with its capacity references now tracking the dynamic size. Heap buffer is freed on all exits, including the existing REG_ESPACE error-path convention for buf.

Testing. Alternations of 60–800 distinct literals through tre_regaexec() at max_cost 1–2, all matching correctly where the unpatched code crashes at ≥ ~200; existing small-pattern behavior unchanged.

Provenance. This fix has been carried in GNU R's vendored copy of TRE since 2011, where it backs R's agrep()/adist().