fix: exclude generated trees from recursive globs

[rogerchappel]

Summary

• Skip .git, dist, and node_modules directories while recursively expanding check globs.
• Preserve sorted, deduplicated project matches and explicit-file access to excluded trees.
• Add isolated CLI regression coverage and document the traversal contract.

Verification

• Tests or checks run: npm ci --ignore-scripts --no-audit --no-fund; targeted recursive-glob tests; npm run release:check; bash scripts/validate.sh; git diff --check origin/main...HEAD
• Manual review completed: full three-file diff and all three commit identities reviewed.

Risk Level

• Low
• Medium
• High

Notes: Glob inputs no longer discover files beneath dependency, VCS, or generated directories. Explicit file paths remain unchanged.

Rollback Plan

• Revert commits 05a56e4, 9da2472, and 56f05e6 in that order.

Human Decision Needed

• None
• Maintainer review
• Product/design decision
• Security/privacy review
• Other:

Commit-by-commit changes

• 56f05e6 test: cover recursive glob directory exclusions — reproduces broad **/*.md traversal and verifies exclusions, deterministic ordering, and explicit-file behavior.
• 9da2472 fix: skip generated trees during glob expansion — prunes the three excluded directory names during recursive traversal.
• 05a56e4 docs: describe recursive glob exclusions — records the user-visible glob contract.

[rogerchappel]

Automated merge note

Triage class: auto-merge

Summary: Skips .git, dist, and node_modules during recursive glob expansion while preserving explicit-file access, with focused regression coverage and aligned README documentation (3 files, +36/-3).

Checks run: GitHub CI Repository hygiene (Node 20), Repository hygiene (Node 22), and Repository hygiene (Node 24) completed SUCCESS; contributor verification recorded npm ci --ignore-scripts --no-audit --no-fund, targeted recursive-glob tests, npm run release:check (31 tests, typecheck, build, smoke, package smoke), bash scripts/validate.sh, and git diff --check origin/main...HEAD. Full diff, mergeability, one-review branch protection, and exact Roger Chappel author/committer identities were re-verified immediately before merge.

Rebased/CI-repaired: No.

Verified head SHA: 05a56e42952b78d1c88b916712dcf72095fa127c.