Detect output outside of package dir during analysis instead of execution

As a safety precaution, we refuse to clean output files if they are outside of the current script's package. However, it would be even better to catch this error earlier, in the Analyzer, by looking at the `output` glob patterns. We just need to be careful that we are parsing and analyzing the glob patterns correctly, accounting for negations, `{}` groups, and other special glob syntax.