script/install-precommit: work where .git is a file (closes #129)

The script wrote the hook to .git/hooks, which fails when .git is a
file rather than a directory, as in a clone made with
--separate-git-dir. It now asks git for the repository's own git
directory with `git rev-parse --git-common-dir`, creates its hooks
directory if missing, and writes the hook there. In an ordinary clone
that is .git/hooks, so nothing moves. git's core.hooksPath setting is
not followed, so the script never writes outside the repository; where
that setting is in force, git does not run the installed hook, as
before.

Model: opus-5-5

TODO.md

@@ -19,8 +19,8 @@ Rationale, Design, TODO, License, Author) if any are still missing.
 
 # Completed Steps
 
-- 2026-10-01: `script/install-precommit` asks git where hooks live, so
+- 2026-10-01: `script/install-precommit` asks git for the repository's git
-  `make hooks` also works where `.git` is a file (closes #129).
+  directory, so `make hooks` also works where `.git` is a file (closes #129).
 - 2026-09-29: the live-DNS test package is renamed `internal/livednstest` and
   added to the `test-support` `deny` list in `.golangci.yml`, so `make lint`
   fails when program code imports it (closes #164).

script/install-precommit

@@ -7,9 +7,11 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    # Ask git where hooks live: .git is a file, not a directory, in some
+    # Ask git for the repository's own git directory: .git is a file, not
-    # checkouts (for example a clone made with --separate-git-dir).
+    # a directory, in some checkouts (for example a clone made with
-    hooks="$(git rev-parse --git-path hooks)"
+    # --separate-git-dir). core.hooksPath is deliberately not followed, so
+    # the hook is never written outside this repository.
+    hooks="$(git rev-parse --git-common-dir)/hooks"
     mkdir -p "$hooks"
     hook="$hooks/pre-commit"
     printf '#!/bin/sh\nset -e\nscript/precommit\n' > "$hook"