## Summary

- consume joined `PathBuf` values through a shared `normalize_path_buf_to_slash` helper
- avoid copying the normalized glob path into a second allocation before matching
- strengthen the `./foo` versus `foo` regression test through the public filter path, including a Windows drive cwd
- document the owned-path rule in the path manipulation guide and link it from `AGENTS.md`

## Why

#10313 correctly inserted lexical normalization into the existing `join -> to_string_lossy -> slash` chain. However, `join` had already produced an owned `PathBuf`; calling the non-consuming `normalize()` API converted it to `Cow<Path>`, and the following string conversion copied the normalized buffer.

The same ownership issue was caught during #10230's review in `file_emitter.rs`, but the general rule never made it into the final style guide. The guide covered consuming relative/slash conversion and exposed `path_buf_to_slash`, but it did not provide a named normalize-plus-slash helper or list the non-consuming owned-path chain as an anti-pattern.

This PR records that missing rule and centralizes the composition so future call sites do not need to reconstruct it.

## Performance

A release-mode `GlobalAlloc` counter around matcher construction reported one fewer allocation/reallocation for each non-bypass relative glob:

| Pattern | Current | This PR |
| --- | ---: | ---: |
| `foo/*.txt` | 3 | 2 |
| `./foo/*.txt` | 4 | 3 |

The probe compared exact outputs across clean, dirty, parent, trailing-separator, absolute, and `**` cases. No benchmark case is added here; if this path is added to continuous performance coverage, the benchmark should land first in a baseline-only PR and the implementation comparison should follow from that baseline.

## Validation

- `just lint-rust`
- `just lint-repo`
- `cargo test -p rolldown_std_utils -p rolldown_utils -p rolldown_common`
- `cargo check -p rolldown_std_utils -p rolldown_utils --tests --target x86_64-pc-windows-msvc --locked`
- `cargo check -p rolldown_std_utils --tests --target wasm32-wasip1 --locked`
- `RUSTDOCFLAGS='-D warnings' cargo doc -p rolldown_std_utils --no-deps --locked`
- `just test-rust` executed the workspace suite successfully until the single `test262_module_code` test stopped on the intentionally uninitialized `test262` submodule; 1,873 integration tests had passed, with no code failure
- adversarial review passed after documenting the strict UTF-8 panic contract