#1123 follow-ups: pin each glob caller's style, wording, read-denials expansion #1129

Follow-ups from the reviews of #1123 (R123c final check, R123d adversarial) at 691ed1c, the fix for #966. None blocks #1123; each is a gap beyond its claims.

1. Untested caller styles (measured, mutants on the compiled head): flipping the glob style at these call sites survives the tests: the two read-denials call sites (flipping the ! exceptions to deny drops a matching astral name from the sandbox entries), docs-only, the size skip, and the experiments' editable paths. Pin each caller's style with a test.
2. Changelog wording (measured, R123d): "a glob with no ? reads exactly as before" is false for a glob with a lone-surrogate literal in allow style. The difference is in the stricter direction.
3. globRegExp doc comment (inferred, R123d): it says any compiled pattern can be spliced into a larger regex, which is false for allow style. Today only deny is spliced (access.ts).
4. read-denials expansion (inferred, R123c): an exception naming an astral character in a ? slot now makes read-denials list the matching files at start instead of passing the glob whole, so a matching file created later isn't sandbox-denied (the hook still denies it). Main takes the same path for any overlapping exception.
5. The PR's own named items: guardrails/engine.ts and the vacuity files still read ? as one UTF-16 unit; confusables.ts globParts; case folding (Push gate routes on main: log config, crafted tree entries, replace refs in the size check, skill dir symlinks, case folding #951 item 5); NFC/NFD beyond push.refuse_paths.