I still think an Adobe Air app is a solid solution to your problem. Provides easy install/updates, supports ssl, allows you full control over the user experience, 110% cross platform, etc... However if you hate Adobe or writing UI code, have you looked into WebDav / the dav4rack gem?
https://github.com/bryanrite/dav4rack-example-devise-subdirectories
That GitHub example uses devise in a rails app for authentication, and used the same credentials for a user to access a private bucket where they can upload files through any WebDav client. Your web app could provide a link that includes the username in the URL to make access more convenient.
OS X's Finder natively supports WebDav through the Finder's "Connect to Server" dialog (Since 10.1.1).
If your user uses Linux, I'm sure they can figure WebDav out.
From scanning http://en.wikipedia.org/wiki/WebDAV it looks like Windows supported WebDav in Win98. However, along with every other web standard, Microsoft has decided to be, um, creative. It sounds like if the user is up to date with KB892211, KB907306, Office, Internet Explorer, OLE-DB and/or "Microsoft Update for Web Folders" they should be able to access WebDav folders over SSL with various authentication schemes with ease. I'm sure all of your Windows users are using Genuine Windows with all the latest updates and a complete Office Suite.
Since your rails app is the WebDav Server, you will be able to throw errors (Can't write that file to the server), post-process uploaded files/directories, and do whatever bookkeeping you need (you have the user's account, along with what they uploaded). Dav4rack is pretty nice. You can use an actual filesystem as a backend, or a database, or bounce the uploaded files to S3, or just about anything you can do in ruby.
I don't think this solution addresses your "find all files recursively that matches a file pattern" component as well as an Air app could. Without real-world experience, I'd imagine that the pattern matching would occur after the upload completes (potentially bandwidth inefficient).