feat(shell): pathname globbing, noglob/set -f, and syscall pathconf

- Add shell-glob.js (fnmatch, brace expansion gate, GLOB_* / DOTGLOB / STRICT_POSIX)
- Tokenizer tracks u/s/d quote segments; expand argv, redirects, and `for … in`
- Builtin `set -f` / `set +f`; richer `case` patterns via bareOsFnmatch
- CI: verify-bundle-throws.mjs + bundle-throw-allowlist.json in pretest
- VFS: symlink cycle detection (ELOOP); stat follow depth 64
- ctx.bareOsPathconf + bareOsSyscall pathconf; syscalls.json schemaVersion 2 + errnoHints
- getconf: pathconf in BARE_OS_SYSCALL_OPS; _PC_*, _POSIX_THREAD_ATTR_STACKSIZE
- Docs: handbook ch.9, environment appendix, user manual ch.4, release-checklist, scripts README
- Tests: tokenize/glob cases in bare-os-booter test.js

Keep posix-conformance-matrix.json bareOsSyscallOps in sync with getconf (add pathconf).

docs/audit/PLACEHOLDER_BASELINE.md

@@ -35,7 +35,7 @@ This document classifies incomplete surfaces as of the kernel hardening pass. It
 
 ## P3 — Vendored `kernel/lib/bare/bundles/*.js`
 
-Upstream-generated IIFEs may contain `TODO` comments, `NOT_IMPLEMENTED` helpers, and abstract stream throws. These are **not** first-party kernel policy; they are rebuilt from `bare-os-bare-libs` and mirrored under `packages/bare-os-seeder/kernel/`. **Inventory:** committed **`docs/audit/bundle-health.json`** (per-bundle bytes, regenerated by **`npm run build -w bare-os-bare-libs`**). **Marker gate:** **`scripts/verify-bundle-markers.mjs`** + **`docs/audit/bundle-marker-allowlist.json`**. Closure strategy: upstream version bumps, allowlist shrink, or bundle post-processing — see **`kernel/lib/bare/README.md`**.
+Upstream-generated IIFEs may contain `TODO` comments, `NOT_IMPLEMENTED` helpers, and abstract stream throws. These are **not** first-party kernel policy; they are rebuilt from `bare-os-bare-libs` and mirrored under `packages/bare-os-seeder/kernel/`. **Inventory:** committed **`docs/audit/bundle-health.json`** (per-bundle bytes, regenerated by **`npm run build -w bare-os-bare-libs`**). **Marker gate:** **`scripts/verify-bundle-markers.mjs`** + **`docs/audit/bundle-marker-allowlist.json`**. **Throw gate:** **`scripts/verify-bundle-throws.mjs`** + **`docs/audit/bundle-throw-allowlist.json`** for `throw new Error("not implemented")` phrasing. Closure strategy: upstream version bumps, allowlist shrink, or bundle post-processing — see **`kernel/lib/bare/README.md`**.
 
 ## Subsystem matrix
 

docs/audit/bundle-health.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-04-04T23:22:39.311Z",
+  "generatedAt": "2026-04-04T23:35:51.774Z",
   "normativeManifest": "packages/bare-os-booter/lib/bare-module-manifest.json",
   "buildTool": "packages/bare-os-bare-libs/build.mjs",
   "bundles": [

docs/audit/bundle-throw-allowlist.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": 1,
+  "description": "Vendored bundles that still contain throw new Error(\"not implemented\") until upstream removes them.",
+  "entries": [
+    { "bundleFile": "bareAsyncHooks.js", "reason": "Upstream async_hooks compatibility throws" },
+    { "bundleFile": "bareUtils.js", "reason": "Upstream util abstract throws" },
+    { "bundleFile": "bareDev.js", "reason": "Upstream dev/hypercore bundle throws" }
+  ]
+}