Document matches function behavior for invalid regex patterns

  Add comments clarifying that matches() returns false for invalid
  regex patterns rather than erroring. This is intentional graceful
  degradation since patterns may be user-provided at runtime.

  Docs:
  - Add comment explaining invalid pattern behavior
  - Add inline comment at error return point

Author: abgoyal

internal/tmpl/engine.go

@@ -1048,14 +1048,15 @@ func isNumericFunc(s string) bool {
 }
 
 // matchesFunc checks if string matches regex pattern.
+// Returns false for invalid patterns (graceful degradation, pattern may be user-provided).
 // Security: Go's regexp uses RE2 engine with guaranteed O(n) matching (ReDoS-safe).
 func matchesFunc(pattern, s string) bool {
 	// Try to get cached regex
 	if cached, ok := regexCache.Load(pattern); ok {
 		return cached.(*regexp.Regexp).MatchString(s)
 	}
 
-	// Compile regex
+	// Compile regex (returns false for invalid patterns)
 	re, err := regexp.Compile(pattern)
 	if err != nil {
 		return false