Add glob file discovery to the agent harness

[nishu-builder]

Summary

• add a decomposed, cached glob worker that returns sparse matching-path trees
• expose glob as a read-only agent tool with bounded path-list rendering and clear pattern errors
• surface the tool in caos-tui and cover direct worker plus offline conversation behavior

Verification

• cargo check --workspace --all-targets
• cargo test --workspace --all-targets
• cargo clippy -p worker-glob -p worker-llm-step -p caos --all-targets -- -D warnings
• nix build
• direct tests/glob/cli.sh through CAOS: pass
• direct tests/chat-offline/cli.sh through CAOS: pass

caos-cli run-tool test was attempted, but the local macOS stdlib publisher could not import the existing cargo-base image because one unpacked build-artifact path is unsupported; after partial publication, the exact command reports the absent bash builtin.

Asana: https://app.asana.com/1/1209016784099267/project/1216019794830986/task/1216814110394502