- **Cross-cutting validation fixes (#3269).** Glob `**/` patterns now stay on
  directory boundaries and name globs honor brace alternates; schema validation
  and export now enforce enum/`uniqueItems` collection constraints and emit
  valid JSON/OpenAPI for `any`, `set`, and nullable unions; MCP file upload
  `accept` matching honors wildcards and extensions; OAuth dynamic registration
  accepts loopback IPv6 and 127/8 redirect hosts; and MCP OAuth resource
  audiences are matched exactly.
