Skip subdirectory listings for shallow glob patterns

[OskarEichler]

Summary

Avoid descending when a String pattern has no path separator: File::FNM_PATHNAME prevents it matching descendants. Patterns containing separators retain their existing traversal; custom string-like objects retain the old path.

Reproduction and evidence

With a root containing file.rb and a directory whose listing fails, glob(root, "*.rb") currently opens the child and raises even though it cannot match any descendant. Fixed returns file.rb after only the root listing. This addresses the traversal concern in #61 without duplicating its installed root-path fix.

Verification

• Baseline and this isolated patch: 433 existing tests / 1,201 assertions, no failures/errors/skips, Ruby 4.0.6 via rbenv, net-ssh 7.3.3, Minitest 5.27.0 and Mocha 2.1.0.
• 200 external assertions cover shallow/recursive patterns, braces, character classes, dot matching, block/array forms, result equivalence to the existing File.fnmatch rules and listing counts. Native OpenSSH pipe checks confirm one listing for *.bin and preserved recursive **/*.rb results.
• Combined candidate also passes the prior 10,384 model assertions, 12,200 additional mixed line/glob assertions, 27 bounded local OpenSSH pipe checks and the existing suite with frozen literals enabled and disabled. Combined checks include the separately proposed Write at the logical position after buffered reads #163–Preserve numeric create and truncate flags in v5 open requests #170 and attributed portions of Handle frozen strings #157/ensure ruby 4 compatibility and address some security concerns #162; these are not additional changes in this PR.
• All 37 package paths and dependency metadata preserved. All 26 runtime files compile on Ruby 4.0.6 and parse as Ruby 2.5. Comparative Lint retains the same 33 baseline findings; no full-green claim.

Breaking changes and limitations

Intentional observable change: shallow patterns no longer perform irrelevant child requests or raise errors from those requests. Returned matches stay unchanged. Prefix pruning for patterns containing slashes, nested dot-entry policy and symlink traversal are not changed.

No repository tests added or modified under the task's no-new-tests constraint; focused scripts ran outside the repository. An external verification Gemfile supplies test tools/RDoc without changing upstream tooling. Older Ruby/JRuby/Windows and upstream CI have not been verified. No production/SSH connections, unrelated upgrades, release changes or signature-equivalence claim.