Windows CI / verify (push) Failing after 1m26s
assertPathInside compared managed-tool paths with path.resolve only, so on runners whose temporary directory surfaces as a Windows 8.3 short path (RUNNER~1) the canonical long executable paths appeared to live outside the owned root and the cutter matrix provisioning contract failed. Resolve both sides through fs.realpathSync.native, walking up through not-yet-existing segments so planned directories keep working, and cover the contract with a real ShortPath regression test plus mixed-existence canonicalization cases.