glob (V2) searches outside the active Location without external_directory approval

Describe the bug

The V2 glob tool resolves its path via path.resolve(location.directory, input.path) and hands the result straight to ripgrep. There is no containment check and no external_directory permission assertion.

That means an absolute path or a ../ sequence escapes the active Location and silently searches (and returns) files outside it, with no approval. Every other filesystem tool (read, edit, write, apply_patch, bash) requires external_directory approval for the same escape, and the V1 glob tool already asserted external directory access (assertExternalDirectoryEffect). So this is a regression in the V2 port.

Steps to reproduce

glob { pattern: "*.env", path: "/etc" }
glob { pattern: "**/*.conf", path: "../../" }

Both run without any approval and return paths outside the Location.

Affected code

packages/core/src/tool/glob.ts — cwd = path.resolve(location.directory, input.path ?? ".") is passed to ripgrep.glob directly.

Fix: resolve through LocationMutation and assert external_directory when the directory lands outside the Location (mirroring read/edit).

Environment

• opencode version: latest dev