fix: gate qualified unsupported regex and Decimal calls (313)

[discreteds]

Scope

• Narwhals-pandas dynamic REGEX_CONTAINS: literal-only pattern gate for Narwhals 2.27.1 AND pandas 3.0.6; literal strings and expression literals remain allowed.
• Register concrete Ibis mysql, singlestoredb and exasol declaration identities.
• Gate public DECIMAL_CAST for those three dialects and REGEX_CONTAINS for Exasol on Ibis 12.0.0 only (backlog 323/330 missing translators).
• Keep unknown versions, existing policy presets and working neighbors unchanged. No backend repairs, package driver shims, remote fixtures or CI changes.

Verification

• TDD: missing regex typed refusal failed before the declaration; eight Ibis protected cases failed before their declarations and passed afterward.
• Affected capability/registry/regex/Decimal suite: 1524 passed, 97 existing skips, 649 xfailed.
• Regex argument contract: 14 passed, 2 xfailed.
• Changed Python Ruff check passed; registry validation passed (131 entries); local upstream audit and generated catalogue freshness check passed.
• Public pandas gate plus literal and Polars dynamic neighbors exercised. Real SingleStoreDB and Exasol bound-backend public compiler smoke passed, with unaffected LOWER SQL.
• Actual Ibis visitor covers all four Ibis gates, newer/unknown package versions, checked/native-debugging/trusted selection. Disposable pandas smoke also verified version and policy boundaries.
• Independent correctness and complexity reviews found no actionable defects.

MySQL verification and limits

The owner clarified that disposable test/spike adapters are allowed; the no-patches restriction applies to package code. With a process-local pymysql.install_as_MySQLdb() alias in the existing MySQL test environment, a real Ibis 12.0.0 MySQL Backend and bound DatabaseTable now exercise the public compile path: DECIMAL_CAST raises the expected BackendCapabilityError and the unaffected LOWER expression compiles to MySQL SQL. No package or test-suite files were patched, no database connection was opened, and no adapter persists after the subprocess exits.

The public compiler verification blocker is cleared. This is not standard mysqlclient qualification or new live MariaDB result qualification. Context-dependent findings from 313 remain open and are not completed by this batch.