fix(redact): install-prepush-hook refreshes a stale managed hook

The marker check returned before the only writer, so once a repo had the
hook, no later change to the wrapper could ever reach it. The `printf x`
fail-open fix (v1.64.0.0) has still not landed in any repo that received
the hook before it, and a wrapper naming a gstack that has since moved
stays pointed at a dead path for the same reason.

Compare the body against what this version generates: rewrite on drift,
stay a no-op when identical. The chained pre-push.local is untouched on
both paths.

The existing trailing-newline regression test cannot catch this — it
installs into a repo with no prior managed hook, the one case that was
never broken.

Wave-amended: spawnSync timeouts added to the new tests (v1.77 sync-spawn tripwire)

test/redact-prepush-hook.test.ts

@@ -420,6 +420,7 @@ describe("install / chaining", () => {
     );
 
     const r = spawnSync("bun", [REDACT, "install-prepush-hook"], {
+      timeout: 30_000,
       cwd: repo,
       encoding: "utf8",
     });
@@ -433,6 +434,7 @@ describe("install / chaining", () => {
     // Behavioural half: the refreshed wrapper actually feeds the final ref line.
     const sha = "c".repeat(40);
     const run = spawnSync("bash", [hook], {
+      timeout: 30_000,
       cwd: repo,
       input: Buffer.from(`refs/heads/main ${sha} refs/heads/main ${ZERO}\n`),
       encoding: "utf8",