chore: bump glob to ^13.0.6

glob@10.x is deprecated upstream and emits a security warning on
install. Jumping to the current major (v13); our usage is just
`await glob(pattern)`, which is unchanged across v10-v13.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bobbyg603