test: cover hidden files in optimized and fallback source globs

[Napolitain]

Related to #2917.

This draft adds tests for recursive source globbing and fingerprint caching
through both the optimized and fallback paths.

add tests for :

• dotfiles and files below dot-directories;
• exact file-set checks for optimized and fallback patterns;
• optimized inclusions combined with optimized and fallback exclusions;
• nonrecursive, wildcard-root, nested-suffix, brace, and multiple-**
  fallback patterns;
• source checksum invalidation through both globbing paths; and
• individually listed generated outputs, so every missing output is checked.

The tests propose that source globs include hidden entries consistently. They
currently demonstrate the mismatch on main: optimized cases pass, while
fallback inclusions omit hidden inputs and fallback exclusions fail to remove
hidden inputs found by an optimized inclusion.

This PR intentionally changes no production behavior and is not merge-ready.
It is a tests-only draft intended to make the inconsistency and its cache impact
concrete while we decide between preserving the historical shell behavior or
adopting consistent hidden-entry inclusion.

Validation:

• golangci-lint run passes with no issues.
• go test ./internal/fsext -count=1 passes.
• The optimized glob and checksum controls pass.
• go test ./... -count=1 fails intentionally only in the new fallback
  expectations under internal/fingerprint.
• Enabling DotGlob temporarily makes the new fingerprint and filesystem tests
  pass; that production change is deliberately not included here.

AI assistance: I used Codex to help develop and validate these tests. I reviewed
and understand the changes.

• I have read and followed the Contribution Guide

[Napolitain]

The behavior choice I would like input on is whether **/* for Task sources
should mean every file below the directory, including hidden entries.

My preference is to include them. A leading dot does not mean that a file is
irrelevant to a task or its cache; a hidden input can still change generated
output. I understand that the more backward-compatible alternative is to make
the optimized path skip hidden entries and preserve the older shell behavior.

The draft is intentionally red and keeps production code unchanged while that
choice is discussed.

[Napolitain]

@andreynering hey, note that the tests fail on purpose. While I am in favor of matching dotfiles via **/*, that needs to be agreed upon and I can understand if you prefer not doing so.