fix(hooks): publish cached tool via ln, not mv

`mv` silently replaces an existing destination, so a slower sibling
process could still clobber a binary another process already
published and might be executing (surfaced as "fork/exec ...
(deleted): no such file or directory"). `ln` (hard link, no `-f`)
fails with EEXIST instead of overwriting, so publishing is now
atomically "first process wins, nobody else touches it" - the temp
dir's own `rm -rf` at the end still finishes the move to the binary's
only remaining name.

- Correct a comment that attributed the stdout-capture contract to
  `populate_tool_cache` itself; it belongs to its caller
  `resolve_tool_path`.
- Add the same `hooks/` existence guard `_run_hook` already has to
  its sibling `_run_concurrent_hooks`, for the same packaging-
  regression message instead of a confusing raw exit code.

Assisted-by: Sisyphus:claude-sonnet-5 opencode

Author: MaxymVlasov

hooks/_common.sh

@@ -583,12 +583,13 @@ function common::populate_tool_cache {
     return 1
   }
 
-  # Redirect the installer's own stdout to stderr: this function's stdout is
-  # a contract (the resolved path, captured via "$(...)" by every caller),
-  # and installers like terraform.sh/tflint.sh call bare `unzip` (no `-q`),
-  # which prints "Archive: ... inflating: ..." to stdout by default -
-  # harmless noise in a Docker build log, but it would otherwise corrupt
-  # the path this function returns.
+  # Redirect the installer's own stdout to stderr: this is a plain
+  # function call, not a "$(...)" capture, so anything printed here
+  # would flow straight through to `common::resolve_tool_path`'s own
+  # stdout - the resolved path, captured via "$(...)" by every caller
+  # of *that* function - and installers like terraform.sh/tflint.sh
+  # call bare `unzip` (no `-q`), which prints "Archive: ... inflating:
+  # ..." to stdout by default.
   if ! (
     cd "$tmp_dir" || exit 1
     export "$env_var_name=$version"
@@ -599,17 +600,12 @@ function common::populate_tool_cache {
     return 1
   fi
 
-  # A sibling may have published while we were downloading - `mv`
-  # doesn't refuse an existing destination, it just replaces it, even
-  # while something else is still executing it.
-  if [[ -x $cached_bin ]]; then
-    rm -rf "$tmp_dir"
-    return 0
-  fi
-
-  # Atomic `rename(2)`: both sides are plain files, so a concurrent
-  # reader never sees a partial write.
-  if ! mv "$tmp_dir/$(basename "$cached_bin")" "$cached_bin" 2> /dev/null; then
+  # `ln` (hard link, no `-f`) fails with EEXIST instead of silently
+  # replacing an existing destination - unlike `mv`, which would
+  # clobber a binary a sibling process may already be running.
+  # `tmp_dir` is a sibling of `cache_dir` (both under the same parent),
+  # so this is guaranteed to stay on one filesystem.
+  if ! ln "$tmp_dir/$(basename "$cached_bin")" "$cached_bin" 2> /dev/null; then
     rm -rf "$tmp_dir"
     # Lost the race - the winner's copy is equally valid.
     [[ -x $cached_bin ]] && return 0

tests/pytest/tool_version_test.py

@@ -352,6 +352,11 @@ def _run_concurrent_hooks(  # pragma: win32 no cover
         Each process' merged stdout/stderr, in start order.
     """
     hook_path = HOOKS_DIR / hook_name
+    if not hook_path.is_file():  # pragma: no cover
+        # `hooks/` is not part of the wheel, only of the sdist, so a
+        # packaging regression must fail with a pointed message here
+        # instead of as a confusing assertion mismatch further down.
+        pytest.fail(f'Hook script not found: {hook_path}')
     processes = [
         subprocess.Popen(  # noqa: S603
             (BASH, str(hook_path), *args, '--', 'a.tf'),