Migrate cli push to glob promise API (fixes silent no-op on glob v9+)

[deathbird]

What

Migrates txjs-cli push from glob's removed v8 callback API to the promise API, bumps glob ^8.1.0 → ^10.5.0, and sorts glob results.

Why

When a workspace resolves glob ≥9 (e.g. a security tool force-upgrading past the deprecated glob@8 line), the old callback never fires, the await never settles, and push exits 0 having uploaded nothing — a silent failure that keeps CI green while no strings reach Transifex. Reproduced on glob 11: prints "Parsing all files…" then exits 0.

Notes

• glob@8.1.0 was not affected by CVE-2025-64756 (that advisory covers glob's CLI in >=10.2.0 <10.5.0 / >=11.0.0 <11.1.0; this uses the library API). Real motivation is glob v9+ compatibility + dropping deprecated glob@8.
• glob v9+ dropped default sorting; .sort() restores deterministic payload order (mergePayload is last-write-wins on developer_comment/character_limit).
• Pin ^10.5.0, not a current major: glob 13 requires Node ≥18, conflicting with this package's engines.node: ">=16.0.0".
• Supersedes Update glob to v10.5 to fix CVE-2025-64756 #239 (community PR by @guaycuru, credited as co-author); adds the sort fix and corrected rationale.
• Follow-ups (separate PRs): exit codes on the bail-out paths, node_modules ignore, --purge safety when files fail to parse, and a regression test for glob ordering.

How to test

---

Block 1: make a tiny sample project (two files sharing a string, so you can see sorting)

mkdir -p /tmp/txtest/alpha /tmp/txtest/zeta
cat > /tmp/txtest/alpha/a.js <<'EOF'
import { t } from '@transifex/native';
t('Hello world', { _comment: 'from alpha' });
t('Only in alpha');
EOF
cat > /tmp/txtest/zeta/z.js <<'EOF'
import { t } from '@transifex/native';
t('Hello world', { _comment: 'from zeta' });
t('Only in zeta');
EOF

Block 2 (Depth 1: does the fix branch work?)

cd ~/tx/transifex-javascript
git fetch origin
git checkout fix/cli-glob-v9-promise-api
cd packages/cli
npm install                       # installs deps incl. glob 10.5.0
./bin/run push /tmp/txtest --fake -v

Expect: ✓ Processed 2 file(s) and found 3 translatable phrases, strings listed, occurrences in
alphabetical order. --fake means nothing is uploaded.

Block 3 (Depth 2, part A: reproduce)

cd ~/tx/transifex-javascript
git checkout master
cd packages/cli
npm install                       #
npm install glob@11 --no-save     # simulate the force-upgrade that broke Kanpla
./bin/run push /tmp/txtest --fake -v

Expect: prints only Parsing all files to detect translatable content... then stops. No "Processed"
line. That's the silent failure.

Block 4 (Depth 2, part B: same glob

git checkout fix/cli-glob-v9-promise-api
./bin/run push /tmp/txtest --fake -v

Do not reinstall here. Leaving glob at v11 is the point. Expect: it now processes both files. Only the code changed.

Cleanup when done

cd ~/tx/transifex-javascript && git checkout master
cd packages/cli && npm install    #version
rm -rf /tmp/txtest

🤖 Generated with Claude Code