feat(shell): pathname globbing, noglob/set -f, and syscall pathconf

- Add shell-glob.js (fnmatch, brace expansion gate, GLOB_* / DOTGLOB / STRICT_POSIX)
- Tokenizer tracks u/s/d quote segments; expand argv, redirects, and `for … in`
- Builtin `set -f` / `set +f`; richer `case` patterns via bareOsFnmatch
- CI: verify-bundle-throws.mjs + bundle-throw-allowlist.json in pretest
- VFS: symlink cycle detection (ELOOP); stat follow depth 64
- ctx.bareOsPathconf + bareOsSyscall pathconf; syscalls.json schemaVersion 2 + errnoHints
- getconf: pathconf in BARE_OS_SYSCALL_OPS; _PC_*, _POSIX_THREAD_ATTR_STACKSIZE
- Docs: handbook ch.9, environment appendix, user manual ch.4, release-checklist, scripts README
- Tests: tokenize/glob cases in bare-os-booter test.js

Keep posix-conformance-matrix.json bareOsSyscallOps in sync with getconf (add pathconf).

docs/audit/bundle-throw-allowlist.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": 1,
+  "description": "Vendored bundles that still contain throw new Error(\"not implemented\") until upstream removes them.",
+  "entries": [
+    { "bundleFile": "bareAsyncHooks.js", "reason": "Upstream async_hooks compatibility throws" },
+    { "bundleFile": "bareUtils.js", "reason": "Upstream util abstract throws" },
+    { "bundleFile": "bareDev.js", "reason": "Upstream dev/hypercore bundle throws" }
+  ]
+}