fix(ci): canonicalize 8.3 short paths in publish-lock diagnostics matching

assertLockedTargetFailure compared the rename paths from the product
publish-lock diagnostic against the expected output file with
path.resolve only. On runners whose temporary directory surfaces as a
Windows 8.3 short path the smoke passes a short-path output file while
the product logs canonical long paths, so a correct atomic publish lock
diagnostic was rejected and the cutter media matrix failed. sameResolvedPath
now canonicalizes both sides through the existing resolveCanonicalPath
helper with a resolve fallback, covered by a ShortPath contract test.

scripts/smoke-test-cutter-media-matrix.js

@@ -665,10 +665,18 @@ function analyzeExport(environment, runtime, definition, source) {
   };
 }
 
+function canonicalComparablePath(candidatePath) {
+  try {
+    return resolveCanonicalPath(candidatePath);
+  } catch {
+    return path.resolve(candidatePath);
+  }
+}
+
 function sameResolvedPath(left, right) {
   if (typeof left !== 'string' || typeof right !== 'string') return false;
-  const resolvedLeft = path.resolve(left);
-  const resolvedRight = path.resolve(right);
+  const resolvedLeft = canonicalComparablePath(left);
+  const resolvedRight = canonicalComparablePath(right);
   return process.platform === 'win32'
     ? resolvedLeft.toLowerCase() === resolvedRight.toLowerCase()
     : resolvedLeft === resolvedRight;