fix: upgrade cross-spawn (ReDoS), harden hook install and spawn handling

[3rd-Eden]

Cross-spawn upgrade + hook hardening

• Bump cross-spawn to ^7.0.5 and which to ^4; drop unused spawn-sync.
• Fix spawnSync result checks (use status/signal/error, not .code).
• Treat non-zero / null close codes from npm run spawns reliably.
• Install hook via absolute path to package hook script for Yarn PnP; chmod 0755.
• Hook: cd to git root before require.resolve; use exec for node.
• Install: guard gitdir parse; avoid fs.existsSync(null) on missing .git.
• Dev: mocha 10, assume 2, nyc; engines node>=16; stub tty in tests.
• Version 1.2.3; add package-lock.json; ignore .nyc_output.

Cleanup folded in from open PRs

This PR also takes care of three long-standing open PRs whose intent
overlaps with the cleanup. Each is implemented from scratch on top of
the new wrapper/hook code rather than rebasing the original branches.

• Update install.js spelling #127 typo fix: install.js says "backed up" instead of "backuped".
• Include workaround for magit with explaining note #148 magit workaround: the generated .git/hooks/pre-commit
  wrapper now unsets GIT_LITERAL_PATHSPECS, and the package hook
  script does the same as defense-in-depth. Fixes the magit
  pathspec ':/' did not match any file(s) error.
• Fix issue where changing branches to one without node_modules would p… #112 missing-package resilience: switching to a branch without
  node_modules (or otherwise removing the pre-commit package) no
  longer blocks commits. The generated wrapper exits 0 if the
  package's hook file is missing, and the hook script exits 0 with
  a friendly warning if require.resolve('pre-commit') fails, instead
  of throwing a Node module-not-found stack trace.

Existing PRs superseded by this one (close on merge)

• upgrade cross-spawn dependency #168 (cross-spawn 7.0.6 only) — incomplete; leaves spawn-sync and the old which, and doesn't fix the code vs status shape mismatch in index.js.
• Update cross-spawn to the latest version 🚀 #145 greenkeeper cross-spawn 7.0.0 — older version of the same.
• Change permissions on pre-commit file from 777 to 775 so it adheres to CIS 6.1.10 #161 chmod 777 → 775 (CIS 6.1.10) — addressed; this PR goes further and uses 0o755.
• Support NVM with sourcetree #137 support NVM with sourcetree — older/narrower version of the still-open Add NVM node precedence if available #164 (kept separate; not addressed here).
• Update assume to the latest version 🚀 #134 greenkeeper assume 2.1.0 — using ^2.3.0 here.
• Update which to the latest version 🚀 #132 greenkeeper which 1.3.1 — using ^4.0.0 here.
• Update spawn-sync to the latest version 🚀 #130 greenkeeper spawn-sync 2.0.0 — spawn-sync removed entirely; cross-spawn ≥ 6 ships a built-in spawnSync.
• Update mocha to the latest version 🚀 #128 greenkeeper mocha 5.1.1 — using ^10.4.0 here.
• stash files before running pre-commit hook to avoid false positives; closes #4 #47 stash files — superseded by the still-open Add an option to stash changes before running hooks #63, which is a separate feature and not addressed here.

Addresses GH-167, GH-160, GH-157; mitigates GH-166 (cwd / exit handling).

[Copilot]

Pull request overview

This PR upgrades spawn-related dependencies to address security concerns and improves the reliability/portability of the git hook installation and hook execution (notably for Yarn PnP and inconsistent hook cwd/exit handling).

Changes:

• Upgrade cross-spawn/which, modernize dev tooling to mocha+nyc, and bump package version/Node engine.
• Harden hook installation and hook runtime behavior (absolute hook path, chmod 0755, cd to repo root, exec usage).
• Add package-lock.json and ignore nyc output.

Reviewed changes

Copilot reviewed 5 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
index.js	Uses status/signal/error semantics for spawnSync results; improves close-code handling from npm run.
install.js	Installs hook via absolute path (PnP-friendly), adds shell quoting, updates chmod mode, and guards gitdir parsing.
hook	Ensures hook runs from repo root; uses exec for the Node invocation.
test.js	Stubs tty.isatty for deterministic color/TTY-dependent behavior in tests.
package.json	Dependency/devDependency updates, switches coverage tooling to nyc, adds Node engine, bumps version.
package-lock.json	Newly added lockfile for dependency reproducibility.
.gitignore	Ignores .nyc_output.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.