--no-ignore semantics for search builtins under embedder ignore scopes

[tobert]

P3 (design decision, then mechanical). grep/glob got --ftype/--hidden/--max-count in the rg-features port but not --no-ignore: the honest semantics of a per-call ignore-bypass under an embedder's Enforced scope aren't designed — should a user flag override the embedder's context-flood protection? Decide once, then add --no-ignore across the search builtins consistently.

• Audit: glob's existing --no-ignore already bypasses the filter unconditionally regardless of scope — confirm intended.
• find under Enforced currently does respect the ignore config, diverging from POSIX find; an agent stuck in Enforced may want find --no-ignore to recover traditional behavior.
• (Ignore is context-control, not a security boundary — the VFS mount is — so this is predictability, not a sandbox hole.)

Migrated from docs/issues.md (P3) in the 2026-07-16 sweep.