fix(framework): treat an exact operator entry as a file, not a subtree (#1194)

Ultron's REQUEST_CHANGES finding B1 on PR #1195: a bare operator manifest entry
such as `tools/git` was matched as an implicit directory prefix, so declaring one
directory silently exempted every framework file beneath it from drift detection.
A drift blind spot is exactly what #1194 exists to close.

An exact entry is now a file carve-out. Subtree ownership must be declared
explicitly as `dir/**`. The same rule is applied on both sides of the Bash/TS
parity boundary: `_mo_matches` in tools/_lib/manifest.sh drops its prefix clause,
and `resolveOwnership` in src/framework/manifest.ts routes operator globs through
a new `matchesOperatorGlob` that requires equality when the pattern has no `*`.

Verified by measurement rather than by report. The new regression declares
operator entry `tools/git`, drifts `tools/git/guard.sh` beneath it, and asserts
the checker exits 1 with `STALE git/guard.sh`:

  at c59a55f8 (broken):  FAILED (failures=1) -- rc 0, summary `stale=0`
  at this tree (fixed):  Ran 6 tests, OK

The failure at the old head is the point. A fixture that passes on the broken
tree measures nothing, and this file's neighbour (#1174) has spent ten rounds
proving it.

Also two shellcheck-only mechanical fixes in manifest.sh: SC1087 (brace the
expansion before `[`) and SC2155 (split `local` from the assignment so the
return status is not masked).

Not validated here: the full package typecheck could not be run in this
workspace -- node_modules is absent and the host filesystem is full. CI covers it.

Reviewed-by: gate-ultron-01 (finding B1)

packages/mosaic/framework/tools/_lib/manifest.sh

@@ -69,7 +69,7 @@ _manifest_glob_to_ere() {
           out="$out.*"
         fi
       else
-        out="$out[^/]*"
+        out="${out}[^/]*"
       fi
     else
       case "$c" in
@@ -87,7 +87,8 @@ _manifest_compile_one() {
   local norm; norm="$(_manifest_norm "$1")"
   [[ -n "$norm" ]] || return 0
   if [[ "$norm" == *"*"* ]]; then
-    local re="^$(_manifest_glob_to_ere "$norm")\$"
+    local re
+    re="^$(_manifest_glob_to_ere "$norm")\$"
     if [[ "$2" == F ]]; then
       _MF_KIND+=(re); _MF_EXACT+=(""); _MF_RE+=("$re")
     else
@@ -183,7 +184,10 @@ _mo_matches() {
   for (( i = 0; i < n; i++ )); do
     if [[ "${_MO_KIND[i]}" == exact ]]; then
       pat="${_MO_EXACT[i]}"
-      [[ "$path" == "$pat" || "$path" == "$pat/"* ]] && return 0
+      # Operator exact entries are file carve-outs, not implicit directory
+      # prefixes. Subtree ownership must be declared explicitly as `dir/**`;
+      # otherwise one bare directory entry can hide all drift beneath it.
+      [[ "$path" == "$pat" ]] && return 0
     else
       re="${_MO_RE[i]}"
       [[ "$path" =~ $re ]] && return 0