test: implement missing glob_fuzz target

[chaliy]

Summary

• Implements the glob_fuzz fuzz target declared in threat model but never created
• Tests glob expansion (via ls), pattern matching (via case), and [[ ]] conditionals
• Limits input to 512 bytes and nesting depth to 15 to prevent OOM
• Added to nightly fuzz workflow matrix in fuzz.yml

Test plan

• Main crate compiles cleanly
• Fuzz target added to fuzz/Cargo.toml and workflow matrix
• Follows existing fuzz target patterns (UTF-8 validation, size limits, timeout)
• CI fuzz compile check will verify it builds with nightly

Closes #915