pre-push tag guard: review follow-ups from #4944 (dispatcher SIGPIPE, install staging, mutant precision) #4945

Non-blocking findings from the two reviews of #4944 (pre-push tag guard). All fail closed today, and none can let a tag through.

• The dispatcher pipes stdin to pre-push.chained under pipefail. A chained hook that exits without reading can SIGPIPE printf and refuse a branch push. Feed it from a here-string or a temp file.
• install moves the old pre-push aside before both installs succeed. Stage the installs under temp names and rename them last.
• A relative-symlink pre-push breaks when moved to pre-push.chained.
• Portability: printf '%(%s)T' needs bash 4.2 or newer, and sha256sum is GNU-only.
• Self-test: per mutant, require the named row to fail, not just any non-zero exit. Allowed rows should assert the "allowed armed release tag" line. Narrow the m12 sed.
• remote_ref: read ls-remote with < /dev/null.

Refs #4942