feat(shell): filename globbing, increment 5 (#34)

[hartsock]

Increment 5 of #34 (ADR 0005 D3): the safe-subset engine now supports filename globbing * / ? / […].

What

• parse.rs — an Arg enum (Lit | Glob); read_word marks a word Glob when it contains an unquoted glob metacharacter (quoted/escaped stay literal). The parser only marks; expansion is the executor's job.
• shell_tool.rs — a pure fnmatch (*/?/[…] with ranges and !/^ negation) + expand_glob (last-segment glob, hidden-file skip, sorted; no match → the literal pattern, bash nullglob-off). Lowering happens in OsSpawner.

The fs enforcement point

Because bridle performs the directory listing, that fs_read is leash-checked in invoke (check_path_read on the listed dir) before any stage spawns — folded into atomic admission. A glob in the program position (argv[0]) is refused (we never exec a pattern). Redirect targets are taken literally (not globbed).

Testing (fully mocked + deep)

• Pure (no fs): fnmatch cases; expand_glob with a fake dir-lister (sorted, hidden excluded, sub-path prefix preserved, no-match→literal).
• Mocked: a glob arg reaches the spawner after the leash; glob-as-program denied; glob dir out of fs_read scope denied with nothing spawned.
• Integration (real fs): cat *.rs → sorted file contents; unmatched glob → literal (cat fails).

Test plan

just check green (fmt + clippy all-features & no-default-features + workspace tests). Part of #34. Leaves only $VAR expansion (allowlist-only, increment 6) for Track A.

🤖 Generated with Claude Code