Document ICU regex policy and track upstream fix

[maphew]

Summary

Over the past two months we've had a stream of PRs and bug reports related to ICU regex linkage (#2986, #2991, #2948, #2965, #3013, #3066, #3112). Multiple agents and contributors have been making overlapping, sometimes conflicting fixes because there was no written policy on how ICU should be handled.

This issue tracks two things:

1. Document the policy (in progress)

Branch docs/icu-policy adds docs/ICU-POLICY.md stating the rule and rationale:

• All release binaries use -tags gms_pure_go (Go stdlib regexp, no ICU)
• CGO stays enabled (needed for embedded Dolt, independent of ICU)
• ICU is a test-only dependency (exercised via test-cgo.sh and CI test matrix)
• Post-build verification catches ICU linkage regressions

Also updates CONTRIBUTING.md and docs/INSTALLING.md to stop telling contributors to install ICU.

2. Track upstream fix

The root cause is that go-mysql-server makes ICU opt-out (gms_pure_go) rather than opt-in. We've opened an upstream issue proposing they invert this:

• Upstream issue: ICU regex dependency causes portability problems for downstream consumers dolthub/go-mysql-server#3506
• Upstream PR (Windows-only fix): fix: use pure-Go regex on Windows to avoid ICU header dependency dolthub/go-mysql-server#3504

Until upstream changes the default, we maintain:

• A fork of go-mysql-server with !windows build constraint (replace in go.mod)
• gms_pure_go tag in every build path
• Post-build binary scanning (scripts/verify-cgo.sh)

Related issues/PRs

• Pre-built Linux binary requires ICU 74, incompatible with Arch Linux ICU 78 #2986 — Linux binary requires ICU 74, incompatible with Arch
• fix: remove ICU runtime dependency from linux-amd64 binary #2991 — Add gms_pure_go to linux-amd64 binary
• fix: add missing //go:build cgo tags to fix non-CGO builds #2948 — Add missing //go:build cgo tags
• [codex] Fix installer ICU/CGO fallback handling #2965 — Fix installer ICU/CGO fallback
• Regression: go install github.com/steveyegge/beads/cmd/bd@latest fails on Windows 11 with missing unicode/uregex.h #3013 — go install fails on Windows
• fix: remove ICU runtime dependency from release binaries #3066 — Remove ICU runtime dependency from release binaries
• fix: resolve go install failure on Windows due to ICU header dependency #3112 — Resolve go install failure on Windows via fork

[maphew]

Closing-the-loop follow-up: #3240 completes the CI enforcement side of this policy. The policy doc and release artifacts were already using gms_pure_go, but the CI test matrix on macOS/Linux was still brew install icu4c / apt-get install libicu-dev and linking real ICU — meaning CI tested a configuration no user ever installs. #3240 drops the ICU installs from all test workflows, adds the tag to 15 test-helper shell-outs, and fixes bd preflight so local pre-PR checks work on no-ICU dev machines.

Also cross-linked upstream at dolthub/go-mysql-server#3506 — maintainer (reltuk) confirmed they won't change the default, so -tags=gms_pure_go everywhere is the permanent answer.