creation_rules path_regex not matched against forward-slash paths on Windows

Summary

On Windows, creation_rules[].path_regex is matched against the raw native-separator relative path (containing \), so regexes written with / — the natural style for cross-platform .sops.yaml shared between Windows/macOS/Linux devs — silently fail to match.

Reproduction

.sops.yaml:

creation_rules:
  - path_regex: secrets/.*\.env$
    age: age1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

On Windows:

sops -e secrets\prod.env
# Error: config file not found, or has no creation rules, and no keys provided through command line

Same command on macOS/Linux against secrets/prod.env works.

Root cause

config/config.go (v3.12.2):

• Line 582 (configPathForFile) strips the config-dir prefix using filepath.Separator, so on Windows the remainder keeps \ separators.
• Line 595 runs reg.MatchString(filePath) against that raw native-separator string.
• Same pattern at line 522 for destination rules.

There is no filepath.ToSlash / strings.ReplaceAll(path, "\\", "/") before the regex match. Consequence: any path_regex using / as a separator (which is what every doc example and every cross-platform config uses) fails to match on Windows.

Users can work around it with [/\\], but that's non-obvious and pollutes shared .sops.yaml files.

Suggested fix

Normalize to forward slashes before matching, so the regex language stays platform-agnostic:

filePath = filepath.ToSlash(filePath)
if reg.MatchString(filePath) { ... }

Applied at both call sites (config.go:522 and config.go:595).

This is a one-line semantics change but strictly widens what matches on Windows — regexes written with [/\\] still match, regexes written with / start matching. No breakage for existing Linux/macOS users.

Environment

• sops v3.12.2
• Windows 11
• PowerShell 7 and Git Bash both reproduce

Start in config/config.go at the destination-rule matching around line 522 and configPathForFile around line 582, especially the regex match around line 595. Check how relative paths are normalized before both matches; done means slash-based path_regex rules match Windows paths while existing platform-specific patterns continue to work.