Fail-closed wildcard rollout parsing
General lesson: when extending a UUID allowlist with a global wildcard, treat the wildcard as a sole, exact sentinel after trimming rather than as another CSV token. Accept only `*`; keep `*,uuid`, `uuid,*`, empty entries, uppercase UUIDs, and malformed input fail-closed. Apply t…