Match a glob against a workspace-relative path. */? do NOT cross /
(so src/*.ts matches only direct children — ** is the recursive form,
matching find/bash semantics); a bare pattern (e.g. *.rs) also matches
the file name at any depth, giving the intuitive “all .rs files”.
Resolve a user-supplied path string (possibly empty, relative, or ~) into a
workspace-confined absolute path. Empty input resolves to the workspace root.
Used by the read-only search/glob tools to scope and confine their root.