fix(macos): read AI tool versions from package.json to avoid Gatekeeper malware prompt

[swarit-stepsecurity]

Problem

Users on macOS see a Gatekeeper dialog during a scan:

"merkle-tree-napi.darwin-arm64.node" Not Opened — Apple could not verify "merkle-tree-napi.darwin-arm64.node" is free of malware that may harm your Mac or compromise your privacy.

merkle-tree-napi.darwin-arm64.node is a native Node addon (a Mach-O dylib) bundled as a transitive dependency of one of the AI CLIs on the machine. A security tool triggering a malware warning is exactly the wrong impression.

Root cause

The AI CLI / agent / framework detectors read each tool's version by executing it with --version (aicli.go getVersion, agent.go getVersion, framework.go getVersion). These AI CLIs are npm-installed Node programs. Launching one boots Node, which dlopens the tool's native .node addons during module init — before argv is even parsed, so the flag is irrelevant. When a quarantined addon (com.apple.quarantine, never cleared after npm download) is loaded, Gatekeeper on recent macOS assesses it and blocks with the popup.

Merely reading a file's bytes never triggers this; only loading/executing does.

Fix

Move version detection to file-based (static-first): read the version from the npm package.json when the binary resolves into a node_modules tree, and only fall back to executing --version for standalone (non-npm) binaries (which are typically notarized, so no prompt).

• package.json's version is npm's required, canonical field (semver) — authoritative, not a heuristic. Verified it matches --version output for the affected tools (e.g. claude: package.json 2.1.209 == claude --version 2.1.209 (Claude Code)).
• Mirrors the existing static-first approach for IDEs in resolveDarwinVersion (which was added to dodge an analogous exec hazard — the "Coveo incident").
• Reuses the node_modules root resolution already in resolveInstallPath (factored into shared nodePackageRoot / resolveRealPath helpers) and the existing readJSONVersion helper. Handles both the Unix symlink layout and the Windows .cmd/.ps1 shim layout.

detectClaudeCowork and detectLMStudioApp already read versions from Info.plist/registry, so they were already safe and are unchanged.

Tests

• TestVersionFromPackageJSON — unit coverage of the shared helper (npm package w/ and w/o package.json, standalone binary, empty path).
• TestAICLIDetector_VersionFromPackageJSON / TestAgentDetector_VersionFromPackageJSON — end-to-end: the detected version comes from package.json and the exec fallback (stubbed with a deliberately different value) does not run.
• Existing install-path tests unchanged and passing (resolveInstallPath behavior preserved).

go build ./..., go vet ./internal/detector/, and go test ./... all green.