Resolve hot-path: stop copying every value, fix whole-collection exclusion

[ndreno]

The two smaller resolve-path follow-ups from the engine review. Independent of each other; grouped because both touch resolution.

1. Stop copying every inspected value (perf)

evaluate_step did value.value.to_vec() for every resolved value before testing it, even for a rule with no transformations, undoing the borrowing the resolver does to avoid exactly that copy. A rule set resolves thousands of values per request and most operators read the value as-is.

Candidates are now Cow<[u8]>:

• No transformations: the value is tested in place, zero copies.
• A no-op transformation (t:none, or t:lowercase on already-lowercase input) returns a borrow instead of allocating.
• Only the value that actually matches is owned, once, for MATCHED_VAR.
• multiMatch still materialises the value before and after each transformation, since it tests each stage.

2. Whole-collection exclusion matched by string prefix (correctness)

A selector-less exclusion (!ARGS) removed every resolved value whose name began with the collection name — so it also stripped ARGS_GET:x and ARGS_NAMES:x, since those start with "ARGS". A rule excluding one collection while inspecting a longer-named sibling silently lost members.

The exclusion now resolves each value name into (collection, member) and matches the collection exactly: a scalar PREFIX, or a map member PREFIX:member. A name that merely starts with the prefix no longer matches. Selector-bearing exclusions were already anchored by the : split, so CRS (which always writes a selector) is unaffected.

Verification

• 172 unit tests pass (+3: no-op-transform match, no-transform match, and the ARGS_GET|!ARGS regression guard); clippy and fmt clean.
• Real CRS 4.9.0 still compiles to 590 rules with the same 4 refusals, and cookie exclusions still behave (__utmz allowed, session blocked).
• The transformation-order and multiMatch tests pass unchanged, so Refuse invalid selectors and backward skipAfter at compile time #1 is behaviour-preserving.