fix: make auto-release path gate CWD-independent

[rianjs]

Closes #25

Root cause

actions/auto-release/gate.sh _split_csv split the path CSVs with an unquoted for x in $1, so each comma-field underwent pathname expansion. The reusable auto-release workflow runs the gate from the repo root, where a monorepo tool-path glob like tools/cfl/** names a real directory — so it expanded into the actual entries under tools/cfl/ (tools/cfl/cmd, tools/cfl/internal, …) instead of staying the literal pattern. No changed file then matched the tool path, so every change to a monorepo tool was skipped.

Confirmed blast radius (reproduced from a repo root, pre-fix): tools/cfl/version.txt, tools/cfl/internal/foo.go, and tools/cfl/go.mod all returned rc=1 (skip). So atlassian-cli's auto-release has silently skipped all change types since it migrated onto the shared workflow — the surviving cfl-v1.0.57 tag predates that migration. Single-tool repos (gro/nrq/slck/cr) were unaffected: their tool glob has nothing to expand against, which is why they release fine.

Fix

Disable globbing for the duration of the split, restoring the caller's prior -f setting (no global state leak; bash 3.2-safe — no array-expansion-under-set -u).

Tests

Added regression cases to test_gate.sh that invoke match-paths from a fixture tree where tools/cfl/ exists. They fail against the old code (3 of them) and pass now. The pre-existing tests passed only because test_gate.sh cds into actions/auto-release/, where the tool glob never expands — i.e. they never exercised the CWD-sensitive path.

# pre-fix, from repo root:
from root: cfl version bump  -> FAIL   from root: cfl go file -> FAIL   from root: cfl go.mod -> FAIL
# post-fix: all green

After merge

Advance the rolling v1 tag so the @v1 callers pick this up, then a version-bump on atlassian-cli will correctly cut the pending signed cfl/jtk releases.