version: ignore foreign npm_package_version in npx contexts

[dutifulbob]

Summary

• fix acpx --version when invoked via npx inside another repo
• only trust npm_package_version if npm_package_name === "acpx"
• otherwise resolve version from acpx package metadata (or fallback)
• add regression tests for foreign npm env leakage

Root cause

npm exec/npx can expose caller-project env variables (for example npm_package_name=openclaw, npm_package_version=2026.2.25).
Our resolver previously trusted npm_package_version unconditionally, which could make acpx --version print the wrong project version.

Validation

• npm run build:test && node --test dist-test/test/version.test.js
• npm run build
• npm run lint
• npm run typecheck
• repro check from another repo context:
  • npm_package_name=openclaw npm_package_version=999.999.999 npm exec --yes --package /home/bob/repos/acpx -- acpx --version
  • result: 0.1.0 (acpx version), not caller env version