fix(glob): keep gitignore matching case-sensitive and POSIX-normalized

Routing the non-negated path through the ignore package introduced two
parity gaps versus fast-glob's native ignore matching:

- The ignore package defaults to case-insensitive matching, while fast-glob
  (caseSensitiveMatch defaults to true) and git match case-sensitively. Build
  the matcher with ignorecase derived from caseSensitiveMatch so a `dist/`
  entry no longer also ignores a differently-cased `Dist/` sibling.
- path.relative yields backslash-separated paths on Windows, which never
  match the forward-slash-anchored patterns. Normalize the relative path with
  normalizePath before ig.ignores(), matching how the patterns are anchored.

Add a case-sensitivity regression test (dist/ vs Dist/).

Author: simonhj

src/utils/glob.mts

@@ -8,6 +8,7 @@ import { parse as yamlParse } from 'yaml'
 import { isDirSync, safeReadFile } from '@socketsecurity/registry/lib/fs'
 import { defaultIgnore } from '@socketsecurity/registry/lib/globs'
 import { readPackageJson } from '@socketsecurity/registry/lib/packages'
+import { normalizePath } from '@socketsecurity/registry/lib/path'
 import { transform } from '@socketsecurity/registry/lib/streams'
 import { isNonEmptyString } from '@socketsecurity/registry/lib/strings'
 
@@ -308,7 +309,13 @@ export async function globWithGitIgnore(
   // The negated-pattern path already worked this way; routing both cases through
   // it removes the asymmetry that left the common, non-negated case crashing on
   // large repos.
-  const ig = ignore().add([...ignores])
+  // Match fast-glob's case sensitivity (its `caseSensitiveMatch` defaults to
+  // true) so routing the non-negated path through the `ignore` package does not
+  // silently start matching case-insensitively, which is the `ignore` package's
+  // own default.
+  const ig = ignore({
+    ignorecase: additionalOptions.caseSensitiveMatch === false,
+  }).add([...ignores])
 
   const globOptions = {
     __proto__: null,
@@ -338,7 +345,12 @@ export async function globWithGitIgnore(
   for await (const p of stream) {
     // Note: the input files must be INSIDE the cwd. If you get strange looking
     // relative path errors here, most likely your path is outside the given cwd.
-    const relPath = globOptions.absolute ? path.relative(cwd, p) : p
+    // Normalize to POSIX separators: the `ignore` patterns are forward-slash
+    // anchored (see ignoreFileLinesToGlobPatterns), so a Windows backslash path
+    // from path.relative would never match them.
+    const relPath = normalizePath(
+      globOptions.absolute ? path.relative(cwd, p) : p,
+    )
     if (ig.ignores(relPath)) {
       continue
     }

src/utils/glob.test.mts

@@ -210,6 +210,28 @@ describe('glob utilities', () => {
       ])
     })
 
+    it('matches gitignore entries case-sensitively, like fast-glob', async () => {
+      // The `ignore` package defaults to case-insensitive matching, but
+      // fast-glob (caseSensitiveMatch defaults to true) and git treat the
+      // ignore set case-sensitively. A `dist/` entry must ignore `dist/` but
+      // leave a differently-cased `Dist/` sibling alone.
+      mockTestFs({
+        [`${mockFixturePath}/.gitignore`]: 'dist/\n',
+        [`${mockFixturePath}/package.json`]: '{}',
+        [`${mockFixturePath}/dist/a.json`]: '{}',
+        [`${mockFixturePath}/Dist/b.json`]: '{}',
+      })
+
+      const results = await globWithGitIgnore(['**/*.json'], {
+        cwd: mockFixturePath,
+      })
+
+      expect(results.map(normalizePath).sort()).toEqual([
+        `${mockFixturePath}/Dist/b.json`,
+        `${mockFixturePath}/package.json`,
+      ])
+    })
+
     it('keeps additionalIgnores anchored even when a gitignore negation forces the streaming path', async () => {
       // A bare `tests` pattern means "the entry `tests` at the scan root".
       // The streaming path uses the `ignore` package for gitignore-translated