refactor(build-cli): use tinyglobby

[tylerbutler]

Description

Migrates build-cli direct glob and branch-pattern matching usage from globby and minimatch to tinyglobby and picomatch.

This keeps the build-cli portion of #25996 separate from the gitignore compatibility work in build-infrastructure and fluid-build. It also adds tests for getRunPolicyCheckDefault so branch matching behavior is documented during the migration.

Reviewer Guidance

The review process is outlined on this wiki page.

This PR is intentionally limited to build-cli dependency replacement and branch matching tests. The gitignore helper changes are split into a follow-up PR.

[github-actions]

Bundle size comparison

Base commit: 4e7fb3e8a246f795c39087cb3c0340e98a00c26f
Head commit: f8bc0f89fa3169835e704b48b4f7d74c6c4416da

Pending — Build - client packages is running. Results will appear here when the build completes.

[github-actions]

Hi! Thank you for opening this PR. Want me to review it?

Based on the diff (104 lines, 6 files), I've queued these reviewers:

• Correctness — logic errors, race conditions, lifecycle issues
• Security — vulnerabilities, secret exposure, injection
• API Compatibility — breaking changes, release tags, type design
• Performance — algorithmic regressions, memory leaks
• Testing — coverage gaps, hollow tests

How this works

• Adjust the reviewer set by ticking/unticking boxes above. Reviewer toggles alone don't trigger anything.

• Tick Start review below to dispatch the review fleet.

• After review finishes, tick Start review again to request another run — it auto-resets after each dispatch.

• This comment updates as new commits land; your reviewer selections are preserved.

• Start review

[Copilot]

Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.

Files not reviewed (1)

• build-tools/pnpm-lock.yaml: Generated file