Module glob_match 

Shared file-pattern glob matcher (B8).

Two call sites need the same “does this path satisfy a rule’s JSON-encoded file_patterns glob list?” logic but with deliberately opposite error handling:

• Rule retrieval (context::retrieval::rules) over-recalls: a parse error or an unbuildable glob set must NOT silently drop a rule — better to surface a maybe-irrelevant rule than to lose real signal on a corrupt file_patterns blob.
• Observation attribution (cloud::observations::dedup) drops: a parse error means we cannot prove the rule applies to the touched file, so the safe call for attribution is to NOT credit it.

The matching algorithm is identical; only the error verdict differs. That divergence is now an explicit GlobErrorPolicy argument instead of two drifting copies.

Enums

GlobErrorPolicy

What to return when the pattern blob can’t be turned into a usable glob set (malformed JSON, no parseable globs, or GlobSet::build failure). Absent / empty / [] patterns are not errors — those are “universal rule” and always match regardless of policy.

Functions

glob_match

Decide whether path is in scope for a rule whose patterns_json is a JSON array of glob strings (e.g. ["src/**/*.rs", "**/*.toml"]).