Rerun glob expansion after build to verify that outputs don't change the inputs

eg. if we have something like:

```
dist/index.html: html/**/*.html
build: build-index
```

If `build-index` generates a `.html` file under `html/` then the targets inputs will be altered, resulting in the target being immediately invalidated.

Instead of this weird failure mode, bit should re-expand the globs, compare them to the old set, and error if they differ.