[Tests] install_nvm_from_git: don't fail when master is at the latest release tag

The avoid_ref check read HEAD's tags via `git for-each-ref` with no --git-dir,
so it inspected the caller's checkout instead of the installed clone.
Whether it passed then depended on which ref triggered the workflow
(the same commit passed when built as the v0.40.6 tag but failed when built as master, since only the former had the tag present),
not on the install result.
Query the installed clone and compare commits,
so a HEAD that is legitimately the latest release commit
(eg master right after a release)
is exempted deterministically.

test/install_script/install_nvm_from_git

@@ -63,9 +63,15 @@ test_install_data() {
     echo "$current_ref" | grep -q "$ref" || die "install_nvm_from_git ${message} did not clone with ref ${ref}"
   fi
 
-  local head_ref="$(git for-each-ref --points-at HEAD --format='%(refname:short)' 'refs/tags/')"
-  if [ -n "${avoid_ref}" ] && [ "${head_ref}" != "${avoid_ref}" ]; then
-    echo "${current_ref}" | grep -q "$avoid_ref" && die "install_nvm_from_git ${message} did clone with unwanted ref ${avoid_ref}"
+  if [ -n "${avoid_ref}" ] && echo "${current_ref}" | grep -q "${avoid_ref}"; then
+    # the avoided tag decorating HEAD is only legitimate if HEAD really is that
+    # tag's commit in the installed clone (eg master released at that tag); query
+    # the clone itself, not the caller's checkout, so the trigger ref cannot skew it
+    local avoid_changeset
+    avoid_changeset="$(git --git-dir "$NVM_DIR"/.git rev-parse --verify --quiet "refs/tags/${avoid_ref}^{commit}" 2>/dev/null)"
+    if [ "${avoid_changeset}" != "${current_changeset}" ]; then
+      die "install_nvm_from_git ${message} did clone with unwanted ref ${avoid_ref}"
+    fi
   fi
 
   if [ -n "$changeset" ]; then