fix(git-hooks): run hook entries and the commit-msg hook without calling bash by name #9774

Parent

Refs #5948

Depends on

• none: on the frontier now

Outcome

No git hook file the plugins install, and not the convention resolver, names bash in its shebang or as a
command, so git bundled with Visual Studio or SSMS (which ships sh.exe and no bash.exe) never resolves
bash to the System32 WSL launcher. Entry points are #!/bin/sh with a POSIX body, or a sh entry that
execs a bash it has checked is not a System32 path.

Decisions

• Step A (owner, 2026-10-13): sh entry point, tests; ships before the config-hook lane.
• The canonical files are lib/git-hooks/install.mjs (its dispatcher runs each entry with bash) and
  lib/resolve-convention-pattern.sh; plugin copies are regenerated with scripts/sync-shared-copies.sh
  (C12: the allowlist hold no longer applies).
• MSYS sh.exe is bash in POSIX mode, so bashisms pass on Windows and break only on dash: test on Linux.

Key interfaces

• lib/git-hooks/install.mjs, lib/resolve-convention-pattern.sh, plugins/guardrails/git-hooks/commit-msg-convention.sh
  and their copies; block-noncanonical-commit and block-convention-violation share the resolver.

Done when

• A test asserts no installed hook entry, the dispatcher it writes, or the resolver names bash in its shebang or as a command, and scripts/run-test-file.sh on it exits 0.
• scripts/run-test-file.sh plugins/guardrails/git-hooks/commit-msg-convention.test.sh exits 0 and runs the hook under dash.
• scripts/run-test-file.sh lib/git-hooks/install.test.mjs and scripts/run-test-file.sh lib/git-hooks/install.test.sh exit 0.
• scripts/run-test-file.sh exits 0 on lib/resolve-convention-pattern.test.sh, plugins/guardrails/hooks/block-noncanonical-commit.test.sh and plugins/guardrails/hooks/block-convention-violation.test.sh.
• scripts/sync-shared-copies.sh --check exits 0.
• scripts/check-changelog-fragments.sh --check-required origin/main exits 0.
• The PR body carries Hold: a human merges this (it changes a commit gate).