fix(filter): glob include respects the pipeline

[bryantbiggs]

Summary

Glob patterns in include: (like *-dev) used to bypass semver:, sort:, and latest:. Writing include: ["*-dev"] alongside a semver: range got every dev tag in the catalog rather than the bounded subset the range implied -- a footgun for the paired-variant mirror pattern (build + runtime tags within a version range).

Glob includes now rescue matching tags from glob: and the project-wide excludes and flow through the rest of the pipeline like any other tag. Literal includes (e.g. latest, exact tag names) keep today's bypass-everything behavior -- every existing recipe uses literals and behaves identically.

The dispatch is by pattern shape: *, ?, or [ makes it a glob; otherwise it is a literal. Mixed include lists route each pattern per its shape.

What changed

• Filter (crates/ocync-sync/src/filter.rs): partition include: patterns by shape at pipeline build time. Globs bypass glob: and the soft-tier excludes; literals stay on the union-after-pipeline path. ~30 LOC of pipeline change.
• Merge layer (src/cli/commands/synchronize.rs): no logic changes; new integration tests pin the YAML round-trip end-to-end (parse → merge → apply).
• Schema (src/cli/config.rs, docs/public/config.schema.json): TagsConfig::include doc comment updated; schema regenerated.
• Docs: new "Include patterns" section in configuration.md, "Build + runtime variants" subsection in recipes/semver-tracking.md, "Tag filtering" section in registries/chainguard.md. Stale descriptions in cli-reference.md, observability.md, and recipes/pin-literals-only.md corrected.

Tests

Filter suite 79 → 89 (1 obsolete test inverted to assert constrained behavior, plus new tests for: literal-bypass through semver, glob rescue from glob:, glob rescue from soft tier, hard-tier still blocks include, glob constrained by semver/sort/latest, mixed literal+glob, non-parseable tag handling, end-to-end YAML round-trip, and per-mapping include: field-replace semantics). Workspace 1361 → 1366.

Test plan

• cargo fmt --all -- --check clean
• cargo clippy --workspace --all-targets --locked -- -D warnings clean
• cargo test --workspace --locked 1366 passed
• cargo deny check clean
• npm run --prefix docs build clean (anchors #include-patterns and #build--runtime-variants verified in generated HTML)
• Reviewer: spot-check the worked example in configuration.md (the trace through 3.12.5, 3.12.5-dev, 3.13.0-dev, 3.12.5-r3) by reading it as a first-time user.
• Reviewer: confirm the corrected prose in recipes/semver-tracking.md ("opt back into prereleases for in-range versions") matches expectations -- this is the one place existing recipe text adjusted for the new semantics.