api: CompiledRegex should carry its MatchMode to prevent silent misuse

Problem

CompiledRegex stores only nfa : GlushkovNfa with no record of the MatchMode used during compilation. Both matchCompiled and searchCompiled call the identical Glushkov.matchString underneath — the mode distinction is only enforced inside desugar (which wraps unanchored patterns with .* in search mode).

This means a caller who compiles with .search and then calls matchCompiled instead of searchCompiled silently gets wrong semantics — no error, no warning.

-- Silent misuse: compiled for search, used as fullMatch
let compiled ← compile pattern .search
let result := matchCompiled compiled input  -- wrong! should be searchCompiled

Proposed fix

Add a mode : MatchMode field to CompiledRegex and assert (or dispatch) on it in matchCompiled/searchCompiled:

structure CompiledRegex where
  nfa  : Glushkov.GlushkovNfa
  mode : MatchMode
deriving Repr

Option A: panic/error if wrong function called for mode.
Option B: merge into a single runCompiled that dispatches based on stored mode.
Option C: remove matchCompiled/searchCompiled and expose only runCompiled.

Option C (single entry point) is cleanest — callers can't pick the wrong function.

Impact

Breaking API change for matchCompiled/searchCompiled. The CLI (LckGrep.lean) and tests need updating.

Start by locating CompiledRegex, compile, matchCompiled, searchCompiled, and desugar, then inspect the CLI entry point in LckGrep.lean and the affected tests. Decide which proposed API shape is intended, update callers and tests, and verify that mismatched match modes can no longer be used silently.