[TheGreatAxios]

Summary

• A Directory Always grant (<dir>/*) covers only paths lexically contained in that directory: the matcher normalizes the subject (POSIX, no filesystem access) and requires a strict anchor/ prefix before the glob ever runs
• The same containment gate applies on the package-evaluation path, which otherwise lets .. walk out through *
• Directory scope minting normalizes the directory through the same shared helper, so a stored grant never carries a collapsible segment
• Warden review required before merge: this change hardens a security-sensitive grant bypass and must not merge without it

Verification

• bun test src/permission passes: 598 pass, 0 fail
• bun run typecheck passes and bun run build passes
• bun run test shows 8595 pass with 1 pre-existing failure in scripts/check-dead-exports.test.ts (missing ts-prune binary; fails identically on clean main)
• bun run lint passes; bun run check:dead-exports fails identically on clean main for the same missing-binary reason

Fixes CL-8989

[linear-code]

CL-8989