The "escaped wildcards" test case creates files named hello* and hello?
on disk, which Windows does not support. Skip this case on Windows since
it's a filesystem limitation, not a matcher bug.

npm lockfiles can contain the same package at multiple versions due to
dependency hoisting (e.g. ini@6.0.0 and ini@4.1.1). Both computeDiff
and AnalyzeCommit used single-value maps keyed by package name, so
duplicate versions collapsed to whichever was iterated last. When the
database and working tree paths iterated in different orders, this
produced phantom "modified" entries on clean workspaces.

Replace single-value maps with multi-maps in both locations:

- computeDiff: group by manifest:name, compare version sets when a
  package appears at multiple versions
- AnalyzeCommit: replace beforeByName/afterByName with multi-maps so
  PreviousRequirement reflects the actual replaced version

Fixes #53

Git's wildmatch supports POSIX character classes like [[:space:]],
[[:alpha:]], [[:digit:]] inside bracket expressions. Our parseBracket
found the first ] as the closing bracket, splitting [[:space:]] into
[[:space:] plus a literal ]. Fix by skipping past [:...:] sequences
when scanning for the closing bracket.

Test cases adapted from git/t/t3070-wildmatch.sh, including multiple
classes in one bracket and mixing ranges with POSIX classes.

In wildmatch, \X inside a bracket expression means literal X. The
bracket parser was blindly doubling all backslashes for the regex
engine, which broke patterns like [\-_] (literal dash and underscore),
[\1-\3] (range 1-3), and [[-\]] (range [ to ]).

The fix processes escape sequences during both bracket scanning (so \]
does not prematurely close the bracket) and content building (so \X
resolves to the literal character).