fix: a glob's **/ matches part of a name, so **/main.cpp selects src/domain.cpp #877

Reproduction

[package]
name    = "globrepro"
version = "0.1.0"

[build]
flags = [ { glob = "**/main.cpp", defines = ["ENTRY_ONLY"] } ]

// src/main.cpp
int domain_value();
int main() { return domain_value(); }

// src/app/domain.cpp
#ifdef ENTRY_ONLY
#error "ENTRY_ONLY reached domain.cpp, a file **/main.cpp does not name"
#endif
int domain_value() { return 0; }

$ mcpp build
error: build failed in globrepro v0.1.0 (.)
failed: obj/domain.o
src/app/domain.cpp:2:2: error: "ENTRY_ONLY reached domain.cpp, a file **/main.cpp does not name"

relative_path_matches_glob (modules/manifest/src/glob.cppm) consumes **/ and then retries the rest of the pattern at every character of the path, not only where a path segment starts. So the rest of the pattern can match the tail of a file or directory name:

The matcher is shared by every glob with the sources grammar: sources, [build] flags, [scan_overrides."<glob>"], test discover, [pack] include/exclude and rerun_if_changed_glob. So the extra files are compiled, get another file's flags or scan result, or are packed or left out.

Expected

**/ matches zero or more whole directories, as in gitignore, Cargo's include and other glob implementations. **/main.cpp matches main.cpp, src/main.cpp and src/a/b/main.cpp, and not src/domain.cpp.

Actual

What follows **/ may start in the middle of a name, so **/main.cpp also selects domain.cpp, xmain.cpp and so on.

Environment

• mcpp version: 2026.10.31.3 (main at ce4dd4b)
• OS: any; the matcher is host-independent (reproduced on aarch64 Linux)