Stage-1 interceptor matching is duplicated between runtime-server and edgebench_judge, and the live copy has zero tests

The Stage-1 interceptor decision — the benchmark's deterministic ground truth — exists in two hand-maintained copies:

• src/clawbench/runtime/runtime-server/server.py:173-185 (_const_fields_match) and :449-477 (url / method / body / params gate) — the real thing, running in-container.
• src/clawbench/eval/edgebench_judge.py:55-94 — a re-implementation whose comment says it "mirrors runtime-server".

Only the mirror has tests (tests/test_edgebench_judge.py). server.py is 878 lines with zero tests and is excluded from pyright (pyproject.toml:74 excludes src/clawbench/runtime). So the copy that decides every published Intercepted number is the unverified one, and any drift between the two means offline judging disagrees with what actually happened during runs.

Ask:

1. Extract the matching predicate into a shared module (e.g. runtime/shared/matching.py) imported by both.
2. Add a parity test over a fixture matrix of url_pattern / method / body / params cases asserting both paths agree — including the regex edge cases from #258 (empty pattern matches everything; malformed pattern raises inside the CDP loop and silently kills interception for the rest of the run).

Start with src/clawbench/runtime/runtime-server/server.py:173-185 and :449-477, then compare the mirror in src/clawbench/eval/edgebench_judge.py:55-94 and tests/test_edgebench_judge.py. Extract the shared matching behavior and add a fixture matrix covering URL, method, body, params, empty patterns, and malformed patterns. Done means both paths agree, including the regex edge cases, with coverage for the runtime-side decision.