getWorkspaceGlobMatches brace expansion

Trap: validating only nonempty outer brace expansion looks sound because each returned alternative is checked, but flatMap silently drops malformed nested branches: packages/{cli,{mcp}} yields cli and passes. Fix: make brace expansion propagate an explicit invalid result through every recursive branch; require a valid, nonempty complete expansion before validating each expanded POSIX glob/path. Apply identically in src/schemas/project_config.ts and src/config.ts. Permit balanced nested braces; reject malformed, empty, absolute, traversal, prototype, option-like, or unsafe alternatives. Do not recurse expanded strings through hasMagic(), which can stack-overflow.