getWorkspaceGlobMatches keeps globSync

Chose synchronous, sorted globSync() workspace expansion over reusing the CLI async parallel walker because configuration loading is deterministic and release-safety-critical, while workspace discovery does relatively little I/O. The walker overlaps directory reads but yields completion-order results and would force async propagation through configuration resolution; retain lexical and realpath containment plus sorted output. Revisit bounded concurrency only after profiling demonstrates expansion is a bottleneck.