feat(npm): S11 semver version validation (Step 7b)

What

Split 2/3 of !427 (closed) (S11 Step 7 validation helpers). Pure semver 2.0.0 version parser/validator. Stacked on Step 7a (!433 (merged)), now merged.

• ParseVersion / ValidateVersion / Version.String — semver 2.0.0 production versions; pre-release and build metadata accepted; build metadata preserved byte-for-byte (ParseVersion(s).String() == s), including its position. Numeric identifiers reject leading zeroes and uint64 overflow.
• FuzzParseVersion — no-panic + round-trip invariants. Adds the fuzz:npm CI job; the file-name/dist-tag fuzz targets it references are benign no-ops until Step 7c defines them (go test -fuzz on a missing target exits 0).

Spec / acceptance

Covers AC 40 (version_invalid). Table-driven units with the build-metadata round-trip and the uint64-overflow boundary.

Notes

• Stacking: 7a (!433 (merged)) has merged; this MR is rebased onto main and the diff shown here is 7b only.