Windows: @Vercel/Nft Emits Globs Outside Job.Base, Causing EACCES Junction Walks

In @vercel/nft static analysis, a dynamic import/require expression resolves to a wildcard glob whose base directory is outside the Next.js tracing base (`job.base`). The tracer lacks a guard to reject or skip globs not rooted under `job.base`, so it recursively scans the Windows user profile, where junction cycles trigger access-denied errors that webpack treats as build failures.

1. On Windows (GitHub windows-latest), create a Next.js 16.2.11 app with `output: 'standalone'` and webpack build. 2. Ensure a traced dependency computes a dynamic path that resolves to `C:\Users\<user>` (home-rooted expression). 3. Run `next build`. 4. Observe hundreds of `EACCES: permission denied, scandir 'C:\Users\runneradmin\AppData\Local\Application Data\...'` errors bubbling out of the tracing glob walk.

This guard changes behavior for any dependency that intentionally resolves dynamic imports outside the project root — those will now be silently skipped, which may cause missing traced files. On case-insensitive Windows filesystems, `path.relative` handles drive-letter and separator differences, but if a custom base uses a different case than emitted paths, the check could be too strict; normalize both paths with `path.resolve()` and `.toLowerCase()` for Windows. Rollback: remove the guard and rebuild. Apply as a patch-package patch to the compiled Next.js copy until upstream release; direct edits to `node_modules` will be overwritten on next install.