Glob tool returns empty for path-prefixed patterns when path parameter is set

Bug Description

The Glob tool returns empty results for any pattern that contains a directory separator (/) when searching from a project root via the path parameter. Only root-level filenames and pure ** wildcard patterns work.

Minimal Reproduction

Given a repo with src/lib/scoring.ts:

| Pattern | Path | Result |
|---------|------|--------|
| src/lib/*.ts | <repo root> | Empty (bug) |
| *.ts | <repo root>/src/lib | Works |
| **/*.ts | <repo root> | Works (but includes node_modules) |
| src/lib/scoring.ts | <repo root> | Empty (bug — exact filename!) |
| CLAUDE.md | <repo root> | Works (root-level file) |

Reproduction Steps

1. Open any Next.js project with src/ directory structure
2. Run Glob(pattern="src/lib/*.ts", path="/path/to/project") → returns "No files found"
3. Run Glob(pattern="*.ts", path="/path/to/project/src/lib") → returns all files correctly
4. Run Glob(pattern="src/components/**/*.tsx", path="/path/to/project") → returns "No files found"

Environment

• Claude Code CLI on macOS (Darwin 25.3.0, arm64)
• Tested across multiple independent Next.js repos — same behavior in all
• Not caused by .gitignore, file count, macOS quarantine/xattr, or node_modules size
• The underlying glob libraries (glob, fast-glob) resolve these patterns correctly when tested independently via Node.js

Impact

This is a silent failure — the tool returns "No files found" instead of an error, which makes it look authoritative. In practice this caused:

• Wrongly concluding source files don't exist
• Wasting ~20 minutes debugging a non-existent problem
• Sending incorrect specs to collaborators based on "missing" files

The workaround is to always set path to the target subdirectory and use patterns without path prefixes, but this is counterintuitive and undocumented.

Secondary Issue

permissions.deny entries in .claude/settings.json (e.g., Glob(node_modules/**)) don't appear to filter results within the same session they're added. May require session restart, or the deny syntax may not apply to Glob results.