fix(rul): globToRegex corrupts mid-pattern /**/ globs (M-BUG-19)

The ? -> [^/] replacement ran AFTER the {{GLOBSTAR_SLASH}} placeholder was
restored to '(?:/.+/|/)', corrupting the group opener '(?:' into '([^/]:' —
every rule pattern containing a mid-pattern '/**/' silently matched only the
zero-dir branch and live rules were flagged 'matches no files' (CA-RUL).
Found by dogfooding /config-audit implement on a throwaway repo copy: the
implementer agent's correct 'posts/**/post.md' rule was flagged dead.

Fix: run the ? replacement before placeholder restoration. Fixture outcomes
byte-identical; frozen v5.0.0 baselines untouched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scanners/rules-validator.mjs

@@ -251,9 +251,9 @@ function globToRegex(pattern) {
     .replace(/\/\*\*\//g, '{{GLOBSTAR_SLASH}}')
     .replace(/\*\*/g, '{{GLOBSTAR}}')
     .replace(/\*/g, '[^/]*')
+    .replace(/\?/g, '[^/]')  // must run BEFORE placeholder restore — '(?:' would corrupt
     .replace(/\{\{GLOBSTAR_SLASH\}\}/g, '(?:/.+/|/)')  // **/ matches 0+ intermediate dirs
-    .replace(/\{\{GLOBSTAR\}\}/g, '.*')
-    .replace(/\?/g, '[^/]');
+    .replace(/\{\{GLOBSTAR\}\}/g, '.*');
 
   // Handle leading patterns
   if (!regex.startsWith('.*') && !regex.startsWith('/')) {