🏗️🔧：let the glob see dot files

[DerekNonGeneric]

The glob() helper in build/utils.mts has never matched a dot-prefixed name, so every dot-config file in the repo has been slipping past the verify and format tasks.

What was happening

Neither * nor ** matches a name beginning with a dot, and fs.glob has no dot option to turn that off. So **/*.yml walked straight past .github/workflows/, and **/*.mjs never saw .remarkrc.mjs.

Eighteen files across five tasks were unchecked:

task	files it could not see
verify.js	.remarkrc.mjs
verify.json	.ecrc.json, .stylelintrc.json, .renovaterc.json5, .markdownlint.jsonc, .markdownlint-cli2.jsonc, .vscode/*.json ×3, .devcontainer/*.json ×2
verify.yaml	.prettierrc.yml, .github/dependabot.yml, .github/workflows/*.yml ×4
verify.toml	.deepsource.toml
verify.md	.github/PULL_REQUEST_TEMPLATE.md, .github/ISSUE_TEMPLATE/1-bug-report.md

verify.dockerfile was unaffected: its pattern names .devcontainer/ outright, and a literal dot in the pattern does match.

The fix

Brace alternation, applied to include patterns in the helper rather than to each caller — being explicit per task is what failed here:

'**/*.yml'  →  '{**,**/.*/**}/{,.}*.yml'

One alternative descends through a dot directory, one matches the dot file itself. A dot directory nested inside another (.a/.b/) is past what the syntax can express; there is none here, and one would have to be named outright.

Matching dot names also brings .git/ within reach of a plain **, so the helper now excludes it as standing policy. Excluded directories are pruned whole, dot entries included, so callers do not need to widen their own exclusions — verified by checking that nothing leaks out of node_modules/.

The fallout

Only two tasks failed once they could see everything, and the second commit fixes what they found:

• .github/dependabot.yml — quote style
• .github/workflows/semgrep.yml — sequence indentation
• .remarkrc.mjs — a hand-wrapped array biome would rather have one entry per line

The remaining sixteen files were already clean. Neither .github/ file is imported content: siteifyHealthFiles only writes to collections/_docs/ and collections/_pages/.

Verification

• nps test — 13/13 tasks pass, up from 11/13 mid-change
• Per-task file counts before → after: json 12 → 22, yaml 3 → 9, js 2 → 3, toml 0 → 1, md 24 → 26
• nps build unchanged: 26 copied, 34 written

Found while looking at #1274, which wants a filename linter — a check that would have been just as blind to .github/ as everything else.

[netlify]

✅ Deploy Preview for gh-pages-openinf ready!

Name	Link
🔨 Latest commit	6663a82
🔍 Latest deploy log	https://app.netlify.com/projects/gh-pages-openinf/deploys/6a7d38cb120d330009b630ff
😎 Deploy Preview	https://deploy-preview-1804--gh-pages-openinf.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.