Function eval_rego_subset 

pub fn eval_rego_subset(module: &str, value_to_test: &str) -> &'static str

Minimal Rego subset — supports the SINGLE pattern shipped in the example PII pack:

default decision := "ALLOW"
decision := "DENY" { re_match(`<regex>`, input.value) }

Anything more complex falls through to the default (fail-open in the reference, fail-closed in prod). Ports _eval_rego_subset.