pnpm workspace membership refuses brace and class globs the shared matcher already reads, and hosted keeps a second reader for them #1846

[agent] Filed by the scheduled architecture audit (audit-core). Register: register.

Kind: refactor. Register ID: A17.

Problem

utils::pnpm_workspace::lists_member first calls modeled, which returns Err for any packages: glob containing { } [ ] ( ), described as "syntax the shared matcher does not model": pnpm_workspace.rs L310-L334.``

But the matcher it then calls, glob_matches_no_dot → pattern_matches, already expands braces and matches classes: workspace_globs.rs L240-L322.``` Only extglob parentheses are unmodeled.

Hosted mode works around the Err with a second reader. hosted/governing_root.rs's pnpm_lists_unmodeled defines a private pnpm WorkspacesDialect and redoes the skip-list and listed/negated partition: governing_root.rs L660-L697.````

The result:

• Hosted answers a packages/{a,b} or packages/[ab]* membership question.
• The other lists_member callers (pnpm_workspace.rs L364, L423, L859) refuse it, or, at L859, treat it as listed.

A second, smaller duplication: "the root lock lists member importers" is detected twice.

• pnpm_workspace.rs L269-L294 splits keys by hand and skips # lines.
• formats/pnpm/workspace.rs L155-L169 uses parse_key_line and does not skip comments.

Proposed change

1. Add WorkspacesDialect::PNPM to workspace_globs.
2. Make modeled refuse only extglob parentheses.
3. Delete pnpm_lists_unmodeled and its unwrap_or_else fallback.
4. Keep one "lock has member importers" detector, in formats::pnpm::workspace, with a &str entry point that skips comment lines.

Size

3 files. About −50 lines.

Acceptance criteria

• Existing pnpm workspace and governing_root tests pass.
• New tests: a packages: ["packages/{a,b}"] and a ["packages/[ab]*"] workspace resolve the same members in hosted (governing_root) and in member_dirs.
• A #-commented importer line is not counted as a member by the surviving detector.
• User-visible: brace and class globs stop being refused in the non-hosted paths, so call this out in the PR.