fix: bound glob expansion outside RPC dispatch (Fixes #535) (#541)

## Summary

Move filesystem glob expansion off the JSONRPC dispatcher so slow
refresh patterns do not block unrelated requests, and bound expansion
work without returning partial inventories.

Fixes #535. Part of #528.

- Keep refresh parsing filesystem-free. Expand in workers, then coalesce
using normalized expanded paths and the current configuration
generation.
- Bound configure/refresh wildcard expansion to two concurrent slots,
1,024 distinct expanded patterns, and 10,000 filesystem candidates. Cap
intermediate brace work as well; requests without wildcards bypass
traversal admission.
- Preserve the pinned glob implementation's matching semantics with
differential tests for braces, recursion, directory-only patterns,
Windows wildcard casing, and symlink/junction paths. Propagate
metadata/traversal failures and limit violations as explicit errors
instead of publishing partial configuration/results.

## Validation

Validated locally on Windows:

- `cargo test --offline --locked --workspace`: **664 passed, 0 failed, 2
ignored documentation examples**.
- `scripts\rust-precommit.ps1`: `cargo fmt --all` and `cargo clippy
--all -- -D warnings` passed.
- `cargo clippy --offline --locked --workspace --all-targets
--all-features -- -D warnings`: passed.
- `git diff --check`: passed.
- Real JSONRPC fixture: duplicate globs returned exactly three expected
environments; malformed and over-limit patterns returned `-4`; a
subsequent `info` request succeeded.
- Repository Reviewer feedback about swallowed metadata errors was fixed
and the follow-up review confirmed resolution.

## Behavior and scope

Exceeding admission/work limits, malformed patterns, and traversal
failures now return explicit JSONRPC errors. These limits are
cooperative: they do not interrupt an OS filesystem call already blocked
in the kernel. The API documentation describes the limits and
compatibility behavior.

This PR does not include the separate #529 EOF-lifecycle or #531
benchmark/schema worktrees. Client-observed timing gates remain tracked
in #531. If #529 lands first, preserve its transport-owned worker
lifecycle when integrating the refresh preprocessing change.

Kept as a draft for cross-platform CI, performance/coverage snapshot
inspection, and review; no Linux/macOS execution or hosted performance
result is claimed from local Windows validation.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: karthiknadig

Cargo.lock

@@ -12,3 +12,6 @@ lazy_static = "1.4.0"
 [dependencies]
 glob = "0.3.1"
 log = "0.4.21"
+
+[dev-dependencies]
+tempfile = "3.10"