fix(cli): guard package version metadata

[ai-hustle-bro]

Summary

• Adds a small readVersionFromPackageJson() guard so package metadata must contain a non-empty string version.
• Keeps the existing fileURLToPath + path.join runtime-read behavior from Fix hard-coded CLI version + add regression test #48 intact.
• Adds focused tests for valid, missing, empty, whitespace-only, non-string, and null version values.

Context

This is the small follow-up suggested in #58 (comment) after #48 landed first.

Validation

• npm test -- test/version.test.ts test/cli.test.ts
• npm run typecheck
• npm run build
• npm test still has the same two Windows path-separator failures unrelated to this change:
  • test/scanner.test.ts > scanEntryPoints > finds src/index.ts as main entry
  • test/heartbeat.test.ts > heartbeat > flags files with stale last_updated frontmatter

[advancedresearcharray]

Rebased onto current main (2c27529) and re-validated locally — npm test -- test/version.test.ts test/cli.test.ts, npm run typecheck, and npm run build all pass on Node 20.

The PR branch was 2 commits behind main; the rebase is clean with no conflicts. A mirrored rebased branch is at advancedresearcharray/mex@codex/guard-package-version (6b49238) until the head branch is fast-forwarded.

@ai-hustle-bro To sync:

git fetch https://github.com/advancedresearcharray/mex codex/guard-package-version
git checkout codex/guard-package-version
git reset --hard FETCH_HEAD
git push --force-with-lease origin codex/guard-package-version

Ready for maintainer review — this adds the version-field guard the maintainer requested in #58.

[advancedresearcharray]

@theDakshJaitly This implements the version-field guard you asked for in #58 — ready for maintainer review.

Status

• Rebased onto current main (2c27529) at advancedresearcharray/mex@codex/guard-package-version (d9f25ce)
• npm test — 178/178 passed (Node 20)
• npm run typecheck and npm run build — passed
• GitHub reports the PR as mergeable and rebaseable

Head branch sync
The PR head on ai-hustle-bro/mex is still at the pre-rebase commit. I don't have push access to that fork. To refresh CI on this PR, @ai-hustle-bro can fast-forward with:

git fetch https://github.com/advancedresearcharray/mex codex/guard-package-version
git checkout codex/guard-package-version
git reset --hard FETCH_HEAD
git push --force-with-lease origin codex/guard-package-version

Alternatively, you can merge from the rebased compare view:
main...advancedresearcharray:mex:codex/guard-package-version

[ai-hustle-bro]

Synced the PR head to current upstream/main (36fb538) and pushed the rebased commit 5b24f37.

Validation rerun locally on Windows / Node 24:

npm test -- test/version.test.ts
npm run typecheck
npm run build
git diff --check upstream/main...HEAD

Result:

• npm test -- test/version.test.ts: 3 passed
• npm run typecheck: passed
• npm run build: passed
• git diff --check upstream/main...HEAD: passed
• Claude Code CLI review of the rebased diff: PASS

Note: npm test -- test/version.test.ts test/cli.test.ts still hits the existing Windows symlink permission failure in test/cli.test.ts (EPERM creating the symlinked bin) in this non-elevated workspace. That test is outside this PR's version-metadata diff; the version-specific test passes after the rebase.