fix(ci): derive the Lefthook fixture lock path from Git's top level

The lock-access cases injected a filesystem failure on a path this spec
predicted from the mkdtemp fixture directory. The installer resolves its
common directory against Git's own top-level path instead, and the host
spells that path differently: Git canonicalizes Windows 8.3 short names
and the macOS /var symlink. When the spellings diverged the injection
never fired, so the probe file was never written and all five cases
failed with ENOENT at the probe read - the signature seen in the Windows
coverage lane.

Resolving the relative common directory against Git's top-level, as the
installer does, makes the expected path identical to the one the
installer touches on every platform. The five cases fail deterministically
on macOS before this change and pass after it.

scripts/install-lefthook.spec.ts

@@ -158,9 +158,16 @@ function gitDirectory(fixture: Fixture, root: string): string {
   return git(fixture, root, ['rev-parse', '--absolute-git-dir'])
 }
 
+// The installer resolves the common directory against Git's own top-level path, and the host
+// spells that path differently from the fixture directory this file created: Git canonicalizes
+// Windows 8.3 short names and the macOS `/var` symlink, while `mkdtempSync` returns the temp
+// directory's own spelling. Resolving the relative common directory against Git's top-level
+// instead of the fixture directory gives the same string the installer computes, so an injected
+// failure on this path reaches the installer's own lock instead of missing it.
 function commonDirectory(fixture: Fixture): string {
+  const root = git(fixture, fixture.main, ['rev-parse', '--show-toplevel'])
   const output = git(fixture, fixture.main, ['rev-parse', '--git-common-dir'])
-  return isAbsolute(output) ? output : resolve(fixture.main, output)
+  return isAbsolute(output) ? output : resolve(root, output)
 }
 
 function hooksPath(fixture: Fixture, root: string): string {