fix(framework): treat an exact operator entry as a file, not a subtree (#1194)

Ultron's REQUEST_CHANGES finding B1 on PR #1195: a bare operator manifest entry
such as `tools/git` was matched as an implicit directory prefix, so declaring one
directory silently exempted every framework file beneath it from drift detection.
A drift blind spot is exactly what #1194 exists to close.

An exact entry is now a file carve-out. Subtree ownership must be declared
explicitly as `dir/**`. The same rule is applied on both sides of the Bash/TS
parity boundary: `_mo_matches` in tools/_lib/manifest.sh drops its prefix clause,
and `resolveOwnership` in src/framework/manifest.ts routes operator globs through
a new `matchesOperatorGlob` that requires equality when the pattern has no `*`.

Verified by measurement rather than by report. The new regression declares
operator entry `tools/git`, drifts `tools/git/guard.sh` beneath it, and asserts
the checker exits 1 with `STALE git/guard.sh`:

  at c59a55f8 (broken):  FAILED (failures=1) -- rc 0, summary `stale=0`
  at this tree (fixed):  Ran 6 tests, OK

The failure at the old head is the point. A fixture that passes on the broken
tree measures nothing, and this file's neighbour (#1174) has spent ten rounds
proving it.

Also two shellcheck-only mechanical fixes in manifest.sh: SC1087 (brace the
expansion before `[`) and SC2155 (split `local` from the assignment so the
return status is not masked).

Not validated here: the full package typecheck could not be run in this
workspace -- node_modules is absent and the host filesystem is full. CI covers it.

Reviewed-by: gate-ultron-01 (finding B1)

packages/mosaic/framework/tools/quality/scripts/test-framework-drift-check.py

@@ -65,6 +65,16 @@ class FrameworkDriftCheckTests(unittest.TestCase):
         self.assertEqual(result.returncode, 0, result.stderr)
         self.assertIn("stale=0 not-installed=0 unsafe-alias=0", result.stdout)
 
+    def test_exact_operator_directory_does_not_hide_framework_drift_beneath_it(self) -> None:
+        self.install_matching()
+        (self.installed / "git" / "guard.sh").write_text("drift-hidden-by-directory-entry\n")
+        self.write_manifest("tools/git\n")
+
+        result = self.run_check()
+
+        self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+        self.assertIn("STALE git/guard.sh", result.stdout)
+
     def test_manifest_is_required_and_policy_changes_take_effect(self) -> None:
         self.install_matching()
         (self.installed / "git" / "guard.sh").write_text("operator-divergence\n")