assertLockedTargetFailure compared the rename paths from the product
publish-lock diagnostic against the expected output file with
path.resolve only. On runners whose temporary directory surfaces as a
Windows 8.3 short path the smoke passes a short-path output file while
the product logs canonical long paths, so a correct atomic publish lock
diagnostic was rejected and the cutter media matrix failed. sameResolvedPath
now canonicalizes both sides through the existing resolveCanonicalPath
helper with a resolve fallback, covered by a ShortPath contract test.