Gate qualified PostgreSQL dynamic-insensitive regex calls (321)

[discreteds]

Scope

Implements the approved narrow gate for backlog 321, within 313. No SQL rewrite, upstream patch, new remote fixture or backend fallback.

• Classify native Ibis literals/dynamic expressions only for selected applicable predicates; unknown matches neither form.
• Preserve conservative, atomic policy publication and existing lowering.
• Gate canonical REGEX_CONTAINS only for dynamic case-insensitive patterns on Ibis 12.0.0, SQLGlot 29.0.1, PostgreSQL 16.15.
• Acquire PostgreSQL version from the actual bound live psycopg connection, not a dialect label or unrelated owner.
• Preserve literal and sensitive plain-column neighbors, native regex errors, trusted/excluded policy behavior and unqualified environments.

Verification

• Affected behavioral suite: 320 passed, 20 xfailed.
• Post-lint predicate tests and typed upstream registry join: 41 passed.
• Changed-file Ruff, upstream registry validation (132 entries), local reconciliation (--skip-github) and generated catalogue freshness: passed.
• Actual PostgreSQL 16.15 / Ibis 12.0.0 / SQLGlot 29.0.1 / psycopg 3.3.6 public witness: six dynamic refusal forms; exact literal, sensitive-column and inline-flag Boolean/null values; native invalid-regex errors; bypass SQL unchanged; actual-owner/closed-driver metadata boundaries.
• Real connection and temporary configured SSH forward closed; disposable execution script removed. No shared data or fixtures created.
• Independent correctness and complexity reviews: no blockers; duplicate trusted test execution consolidated.

Remaining limits

This gate does not repair native SQL generation or qualify other version combinations. Case-sensitive concatenated patterns remain unresolved. Backlog 321 and parent 313 stay open. No type checker or full repository suite was run.