### Summary
fix: lefthook deps serialization
Extract npm ci guard into web-deps job; use native deps for
serialization instead of a mkdir mutex that could leave stale locks on
interrupted commits. Also use single quotes in echo to work around
lefthook v2.1.10 stripping double quotes on Windows.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Replace fragile wall-clock timeout assertions with semantic checks for
deadline errors, retry suppression, and event ordering. Keep only
lower-bound timing checks where they prove backoff behavior. This
reduces CPU-load flakes without weakening regression coverage.
