Refuse a key index with no hardened child

Every element of the derivation path is hardened, so an index above
2147483647 has no child to derive: the hardened offset wrapped around
and the tool silently produced a non-hardened key that no other
implementation reading the path as written would reproduce. Such an
index is now refused with a message before anything is derived, and
tests pin the refusal at both the derivation and the command level.

Also use the hook path variable in script/install-precommit instead of
repeating the literal beside it.

Model: opus-5

script/install-precommit

@@ -8,8 +8,8 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 main() {
     cd "$ROOT"
     hook=".git/hooks/pre-commit"
-    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
-    chmod +x .git/hooks/pre-commit
+    printf '#!/bin/sh\nset -e\nscript/precommit\n' > "$hook"
+    chmod +x "$hook"
     echo "pre-commit hook installed: runs script/precommit"
 }