lib+test: add fnmatch over Hare sea-of-stars

Port of ref/hare/fnmatch/fnmatch.ha. Public surface mirrors Hare:
`flag` enum (NONE/PATHNAME/NOESCAPE/PERIOD) and `fnmatch(pattern,
string, flags) bool`.

Algorithm is the three-phase sea-of-stars (also used in musl):
exact-match the prefix before the first `*`, exact-match the tail
after the last `*`, then greedily match each star-delimited middle
segment with backtrack on inner failure. No exponential corner —
each star anchors a "match found" at strictly increasing positions.

Bracket expressions: Hare-strict — `!` for negation, `^` rejected
as invalid; `]` as first member legal, trailing `-` literal, all
12 POSIX classes ([:alnum:] … [:xdigit:]) via direct streq + the
ascii.is* predicates.

Divergences from Hare (documented in fnmatch.ww docblock):
  - byte-indexed cursors in place of strings::iterator (no UTF-8
    rune iter yet); ASCII-only meaningful, multibyte matches
    byte-identically. Graduates "in one go" per lib/CLAUDE.md
    when the language stack grows rune iteration.
  - invalid pattern collapses to `false` at the public boundary
    (Hare's `b is bool && b: bool;`); a try-shaped diagnostic
    entry can be added later without churning the surface.
  - tail-match uses a forward cursor at `string.len - cnt`
    instead of riter/prev — same byte sequence either way.

Test fixture follows the project's helper-per-row table-driven
shape (precedent: lib/encoding/base32/base32_test.ww). 8 @test
fns clustered by feature (basic / brackets / ctype / period /
noescape / musl_basic / pathname / combined), ~95 rows total
adapted from Hare's +test.ha plus musl-derived edge cases.

Wired as 972_fnmatch_run alongside 970_fmt_run / 971_log_run in
the stdlib-runtime band.

Unblocked by 7f60ebb (cstage+wwstage SK_USE→SK_X promotion
missing use_alias), which is what let the module name `fnmatch`
coexist with an exported leaf fn `fnmatch`.

test/wcc/972_fnmatch_run.c

@@ -0,0 +1,52 @@
+/*
+ * 972_fnmatch_run — execute the lib/fnmatch @test fixture under the
+ * C-side `ww run` driver and assert exit 0.
+ *
+ * fnmatch is a pure leaf (depends on ascii + strings only) sitting
+ * alongside fmt (970) and log (971) in the stdlib-runtime band. The
+ * fixture (fnmatchtest.ww) carries its own `export fn main()` that
+ * drives the @test fns and signals which case failed via the exit
+ * code, so this file is a thin wrapper — no @test scanning, no
+ * synthetic main generation.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/wait.h>
+
+static int
+runwait(const char *cmd)
+{
+	int rc = system(cmd);
+	if (rc == -1) return -1;
+	if (WIFEXITED(rc)) return WEXITSTATUS(rc);
+	return 1;
+}
+
+int
+main(void)
+{
+	const char *bin = getenv("BIN");
+	if (!bin) bin = "out/bin";
+	char absbin[1024];
+	if (bin[0] != '/') {
+		char cwd[1024];
+		if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+		snprintf(absbin, sizeof absbin, "%s/%s", cwd, bin);
+		bin = absbin;
+	}
+	char cwd[1024];
+	if (getcwd(cwd, sizeof cwd) == NULL) return 1;
+
+	const char *src = "lib/fnmatch/fnmatchtest.ww";
+	char path[1024], cmd[2048];
+	snprintf(path, sizeof path, "%s/%s", cwd, src);
+	snprintf(cmd, sizeof cmd, "%s/ww run %s", bin, path);
+	int rc = runwait(cmd);
+	if (rc != 0) {
+		fprintf(stderr, "fnmatch_run FAIL: %s exited %d\n", src, rc);
+		return 1;
+	}
+	printf("fnmatch_run: %s ok\n", src);
+	return 0;
+}