refactor(gateway): run the request guards on core's tw-guard engines

Cargo.toml

@@ -68,9 +68,9 @@ opt-level = 3
 # never re-exported through a local shim. And the reverse: something only
 # this side uses (the at-rest crypto, SigV4, the gateway error) lives here,
 # not in core.
-tw-breaker = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.42.0" }
-tw-dialect = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.42.0" }
-tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.42.0" }
+tw-breaker = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.43.0" }
+tw-dialect = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.43.0" }
+tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.43.0" }
 
 # Web framework
 axum = { version = "0.8", features = ["macros", "ws"] }

crates/common/Cargo.toml

@@ -31,7 +31,6 @@ metrics = { workspace = true }
 clickhouse = { workspace = true }
 bytes = { workspace = true }
 url = { workspace = true }
-regex = "1"
 # S3-compatible body offload (matches the same SigV4 + reqwest pattern
 # the Bedrock provider uses — no aws-sdk-s3 dependency, so the build
 # cost stays a couple hundred LOC for what's effectively GET/PUT/DELETE

crates/common/src/lib.rs

@@ -48,6 +48,5 @@ pub mod crypto; // AES-256-GCM envelope for secrets at rest
 pub mod fixed_window;
 pub mod json_secret; // `{"$enc": ...}` — a secret nested inside a JSONB column
 pub mod pii; // BlobRedactor — at-rest body redaction shared by gateway + mcp-gateway
-pub mod regex_util;
 pub mod tasks; // supervised_spawn — panic-isolated background tasks
 pub mod validation;