fix: validate rules and recursive check globs

[rogerchappel]

Summary

• validate the complete rules document at runtime with stable, field-specific errors
• expand *, ?, and recursive ** inputs deterministically while enforcing that every pattern matches
• cover valid and malformed rules, recursive and overlapping inputs, and document the supported behavior

Verification

• Tests or checks run: npm run release:check
• Tests or checks run: git diff --check origin/main..HEAD
• Manual review completed

Commit-by-commit changes

• fix: validate rules and expand recursive globs — adds schema checks and deterministic recursive file discovery
• test: cover rules validation and recursive globs — adds unit and CLI regression coverage
• docs: define rules and glob validation — documents supported syntax, constraints, and error behavior

Risk Level

• Low
• Medium
• High

Notes: Invalid rules and unmatched literal inputs now fail earlier with stable diagnostics, matching the documented strict-input contract.

Rollback Plan

• Revert the three commits in this PR to restore the previous rules parsing and input expansion behavior.

Human Decision Needed

• None
• Maintainer review
• Product/design decision
• Security/privacy review
• Other: