Refuse a key index with no hardened child

Every element of the derivation path is hardened, so an index above
2147483647 has no child to derive: the hardened offset wrapped around
and the tool silently produced a non-hardened key that no other
implementation reading the path as written would reproduce. Such an
index is now refused with a message before anything is derived, and
tests pin the refusal at both the derivation and the command level.

Also use the hook path variable in script/install-precommit instead of
repeating the literal beside it.

Model: opus-5

internal/cli/cli_test.go

@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"git.eeqj.de/sneak/keyfunc/internal/cli"
+	"git.eeqj.de/sneak/keyfunc/internal/derive"
 	"git.eeqj.de/sneak/keyfunc/internal/mnemonic"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
@@ -62,6 +63,14 @@ func TestThePrivateKeyMatchesThePublicOne(t *testing.T) {
 	require.Equal(t, vectorOne, back)
 }
 
+func TestAnIndexWithNoHardenedChildIsRefused(t *testing.T) {
+	t.Setenv(mnemonic.Variable, example())
+
+	out, err := execute(t, "ssh", "pub", "-n", "2147483648")
+	require.ErrorIs(t, err, derive.ErrIndexTooLarge)
+	require.Empty(t, out)
+}
+
 func TestTheMnemonicCommandIsUsed(t *testing.T) {
 	t.Setenv(mnemonic.Variable, "")
 
@@ -77,6 +86,17 @@ func TestTheMnemonicCommandIsUsed(t *testing.T) {
 func run(t *testing.T, args ...string) string {
 	t.Helper()
 
+	out, err := execute(t, args...)
+	require.NoError(t, err)
+
+	return out
+}
+
+// execute runs the tool and returns both what it wrote and how it
+// ended.
+func execute(t *testing.T, args ...string) (string, error) {
+	t.Helper()
+
 	var out bytes.Buffer
 
 	root := cli.Root()
@@ -84,7 +104,7 @@ func run(t *testing.T, args ...string) string {
 	root.SetErr(&out)
 	root.SetArgs(args)
 
-	require.NoError(t, root.ExecuteContext(t.Context()))
+	err := root.ExecuteContext(t.Context())
 
-	return out.String()
+	return out.String(), err
 }