[thekevinbot]

A path-table pattern that names node_modules after a glob component ('./**/node_modules/**', './*/node_modules/*/*') now scans it. Before, only a node_modules in the literal prefix counted as naming it. The approved divergence in #1255 is "node_modules skipped unless the path names it", and a literal node_modules component anywhere in the pattern names it. Patterns that don't name it ('./**', './**/*.js') still skip it.

How it works: PathTable::default_ignores drops the built-in **/node_modules/** rule for a table whose glob has a literal node_modules component. Db now keeps only the configured ignore patterns and adds each table's defaults when it creates the table. A configured node_modules ignore still applies. The stat form and the --on-file form both go through this path.

Compared with bash -O globstar -O nullglob (dotglob off) on a fixture with node_modules/top.js, node_modules/pkg/index.js, pkg/node_modules/dep/i.js and src/a.js, under --no-ignore. dirsql now lists the same files bash does, leaving out directories, for './**/node_modules/**', './**/node_modules/*/*', './*/node_modules/*/*', './node_modules/*' and './pkg/node_modules/**'. For './**' and './**/*.js' it still returns only src/a.js, which is the approved divergence.

Fixes #1271

E2E Verification

• Ran e2e suites locally for every affected SDK
• Python SDK e2e: pass
• TypeScript SDK e2e: pass
• Rust core e2e (if applicable): pass
• packages/python/e2e-attestations/<branch>.json receipt written if packages/python changed (just e2e-attest-python)
• packages/ts/e2e-attestations/<branch>.json receipt written if packages/ts changed (just e2e-attest-ts)
• Command(s) run (after merging main): uv run maturin develop --release, just e2e-attest-python, just e2e-attest-ts, cargo test --workspace --features cli, just preflight without the mutation gate
• Result summary: python 40 passed; ts 18 passed; cargo workspace all green; preflight 0 failing

Changelog / Migrations

• Changelog fragment added under <root>/<pkg>/changelog.d/ for each changed package
• Migration fragment with the same slug added under <root>/<pkg>/migrations.d/ for each changed package

Merge with main

main did not compile its unit tests after #1277 and #1278 merged: #1277's two new Walk { .. } test initializers lacked #1278's in_repo field. The merge adds in_repo: false to both, and re-pins the src/scanner.rs mutation waivers in testing-conventions.toml to the lines they guard after #1277 shifted them.