prepare next release

<!-- agent -->
Opening a linked worktree created from a bare repository read `core.bare` from the
common repository and discarded the worktree path.

Keep a discovered linked worktree non-bare when its administrative directory has
a `commondir` marker. The regression compares Git rev-parse behavior and verifies
Repo.bare and working_tree_dir.

Git baseline: 0bd5a6920d7c4238e0d90ddc0e7e08866e84a0f1;
environment.c:is_bare_repository() and setup.c:check_repository_format_gently().
Git 2.50.1 reports the linked checkout as non-bare.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

<!-- agent -->
Cygwin patches ensurepip to load setuptools and pip wheels from
`/usr/share/python-wheels`. The rolling python-pip-wheel package advanced to pip
26.2.1, which requires Python 3.10 or newer, so every Python 3.9 venv creation
failed—including the installation test's nested virtual environment.

Keep the single Cygwin lane on Python 3.9 because the regular matrix already
covers Python 3.12 and newer. Install Cygwin's setuptools wheel, download pip
26.0.1 from its immutable PyPI URL into ensurepip's shared wheel directory,
verify its SHA-256 digest, and avoid upgrading pip. This fixes all venv creation
without relying on a version that may disappear from rolling Cygwin mirrors.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

Keep bare-repository worktrees non-bare

GHSA-59cr-6r3x-644w identifies that submodule update paths could reach
filesystem operations without the containment check already used by add and
move.

Add a regression that proves update rejects a parent-directory checkout
path before cloning, and override Submodule.abspath to apply the shared
_to_relative_path guard for every filesystem consumer.

Git baseline: git.git read-cache.c verify_path_internal() rejects invalid index
paths, covered for parent traversal by t/t9300-fast-import.sh.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

…dening

Reject unsafe submodule checkout paths

Bumps the pre-commit group with 1 update: [https://github.com/astral-sh/ruff-pre-commit](https://github.com/astral-sh/ruff-pre-commit).


Updates `https://github.com/astral-sh/ruff-pre-commit` from v0.16.0 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff-pre-commit/releases)
- [Commits](astral-sh/ruff-pre-commit@v0.16.0...v0.16.5)

---
updated-dependencies:
- dependency-name: https://github.com/astral-sh/ruff-pre-commit
  dependency-version: 0.16.5
  dependency-type: direct:production
  dependency-group: pre-commit
...

Signed-off-by: dependabot[bot] <support@github.com>

…mit/pre-commit-d501b75439

build(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.0 to 0.16.5 in the pre-commit group