How do you regression-test a ReDoS fix without hanging CI?

A known-bad regex is useful evidence, but putting it directly in the test process can hang the runner before the timeout assertion fires.

The boundary I am using:

run each adversarial case in a fresh worker thread or child process

let the parent own a hard timeout and terminate the child

keep semantic-parity fixtures separate from timing guards