fs: let glob walk a mounted virtual file system

[samuelmbabhazi]

Since the native glob (#65392), fs.glob(), fs.globSync() and fsPromises.glob() find nothing in a mounted virtual file system: the walk reads the file system with libuv, which cannot see a mount point, where the JavaScript walk it replaced read through the fs hooks. On v26.11.1 the walk below finds the files; on main it returns [] for every API:

const myVfs = vfs.create();
myVfs.mkdirSync('/data/sub', { recursive: true });
myVfs.writeFileSync('/data/a.txt', '');
myVfs.writeFileSync('/data/sub/b.txt', '');
const cwd = `${myVfs.mount()}/data`;
fs.readdirSync(cwd, { recursive: true });   // [ 'sub', 'sub/b.txt', 'a.txt' ]
fs.globSync('**/*.txt', { cwd });           // v26.11.1: [ 'a.txt', 'sub/b.txt' ], main: []

This gives the native walk a reader. When the walk's cwd is under a mount, or one of its patterns names a mount absolutely, the hooked readdirSync(), lstatSync(), statSync() and realpathSync.native() serve its scandir, lstat, stat and realpath reads, so a mount and the real file system are walked by the same engine, with the same patterns, exclude (patterns and callback, with and without withFileTypes), maxDepth and followSymlinks semantics. A walk that reads nothing under a mount is unchanged.

Details:

• src/glob/glob_walker.{h,cc}: an FsReader interface on WalkOptions, consulted by the guarded walk in place of libuv. A walk with a reader never runs free (the free walk and the listing prefetcher scan with raw libuv calls from pool threads) and tells two spellings of a directory apart by realpath, as on Windows: a virtual file system need not have inodes (the in-memory one numbers every stat() call afresh).
• src/glob/node_glob.{h,cc}: JsFsReader calls a JavaScript function (op, path), like JsExcludeFilter calls the exclude callback. For the asynchronous APIs, a request with a reader runs each slice on the main thread from a SetImmediate, one batch per pull, so a walk still settles from a later loop turn and an iterator left early still cancels it. The pull's settlement is factored into Resolve()/Reject(), shared with the thread-pool path.
• lib/internal/vfs/setup.js: the globReader(cwd, patterns) handler, which gives the walk its reader when the walk can reach a mount. A read that fails answers as a missing path, as the walk's own reads do. The reserved root sits under os.devNull, which is a character device, and the walk descends an absolute pattern from the root one segment at a time, so to the walk that one path is a directory holding the reserved root.
• lib/internal/fs/glob.js: passes the reader to the binding.

The test covers the three APIs: relative patterns from a cwd under the mount (**, dot directories, symbolic links with and without followSymlinks, maxDepth), exclude as patterns and as a callback with and without withFileTypes, absolute patterns into the mount and into the reserved root from a real cwd, a .. pattern within the mount, the reserved root as cwd, the real file system while a VFS is mounted, a throwing exclude callback, early exit from the iterator, a tree larger than one batch, and the unmounted path.

Verified locally on Linux: the new test, every test/parallel/test-vfs-* test, test-fs-glob* and test-path-glob pass.

[github-actions]

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

• the guide for first-time contributors
• the contribution and automation policies
• the pull request guide
• the AI use policy
• the Code of Conduct

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.