release-25.4: pkg/cli: support full zip path matching in --include-files/--exclude-files

[Abhinav1299]

Backport 1/1 commits from #163266.

/cc @cockroachdb/release

---

Previously, the --include-files and --exclude-files flags in debug zip
only matched against the base file name (e.g. "details.json"). This made
it impossible to filter by location within the zip archive, for example
including only a specific node's files, or excluding per-node ranges.json
while keeping the cluster-wide copy.

This commit extends the file filter flags to support full zip path
matching. Patterns without '/' continue to match the base file name,
preserving the backward compatibility. Patterns with '/' are matched
against the full path within the zip archive using filepath.Match
semantics (e.g. "debug/nodes/1/.json" or "debug/nodes//ranges.json").

The core change adds a zipPath parameter to shouldIncludeFile and
isIncluded, with a matchPattern helper that routes each pattern to the
appropriate match target. Server-side retrieval patterns only forward
base-name patterns since the server does not know the zip directory
layout.

Fixes: #158450
Part of: CRDB-57302
Epic: none
Release note (cli change): The cockroach debug zip command's
--include-files and --exclude-files flags now support full zip path
patterns. Patterns containing '/' are matched against the full path
within the zip archive (e.g. --include-files='debug/nodes/1/*.json').
Patterns without '/' continue to match the base file name as before.

Release justification: This change is needed to unblock an active customer investigation
runbook. The current workaround for collecting faster "lite" debug zips uses --exclude-files='*.pprof',
but this over-excludes: it drops per-node cpu.pprof and heap.pprof (<1% of zip size) which are
critical for diagnosing cluster behavior at collection time. The actual bloat comes from historical
profiles in heapprof/ folders (49% of zip size). Without path-based filtering there is no way to
exclude heapprof/* while retaining the current profiles -- the only option is the blunt *.pprof
which sacrifices essential diagnostic data. This change enables surgical patterns like --exclude-files='debug/nodes//heapprof/' to target the bulk data. The change is backward compatible and
additive only.

[blathers-crl]

Thanks for opening a backport.

Before merging, please confirm that it falls into one of the following categories (select one):

• Non-production code changes OR fixes for serious issues. Non-production includes test-only changes, build system changes, etc. Serious issues are defined in the policy as correctness, stability, or security issues, data corruption/loss, significant performance regressions, breaking working and widely used functionality, or an inability to detect and debug production issues.
• Other approved changes. These changes must be gated behind a disabled-by-default feature flag unless there is a strong justification not to. Reference the approved ENGREQ ticket in the PR body (e.g., "Fixes ENGREQ-123").

Add a brief release justification to the PR description explaining your selection.

Also, confirm that the change does not break backward compatibility and complies with all aspects of the backport policy.

All backports must be reviewed by the TL and EM for the owning area.

[blathers-crl]

✅ PR #164149 is compliant with backport policy

Confidence: high
Critical bug criteria met: [An inability to detect and debug production issues]
Backward compatible: true
Explanation: The PR is compliant with the backport policy due to the inclusion of a 'Release justification:' line in the PR body. The justification provided states that the change is necessary to unblock an active customer investigation runbook and is critical for diagnosing cluster behavior at collection time. This aligns with the policy's exception for release justifications, clearing the PR of standard backport policy requirements irrespective of whether it addresses a critical bug or includes a feature flag.

Additionally, the PR description indicates that the changes are backward compatible and only additive, preserving backward compatibility as required by the policy. The expression of critical diagnostic data preservation and enhancement of the existing debug capabilities suggests alignment with the policy's criteria for critical bugs, ensuring the PR's relevance and necessity.

✅ ENGREQ Check Passed: No ENGREQ required (non-production code or serious issues).

_{🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}

[cockroach-teamcity]

This change is