WorkspaceNameSchema literal glob magic

Trap: allowing glob-character segments in every configured workspace key looks necessary for valid patterns such as packages/[!a]*, but hasMagic() treats literals like packages/foo], packages/foo!, and packages/foo^ as non-patterns. They then bypass concrete-path validation. Fix: permit glob-only characters only when the key is an actual supported Glob pattern; otherwise require isSafeWorkspacePath() in both schema validation and config resolution. Test malformed literals alongside valid character-class patterns.