fix(cli): treat non-numeric version cores as not comparable, never "ahead"

Copilot review catch on #669: compareVersions parsed core segments with
Number.parseInt and NaN !== NaN made any malformed version (v1.0.0, 1.0.x,
garbage from a corrupt manifest) deterministically compare as GREATER —
classifying it 'ahead' and suppressing the align/reinstall guidance exactly
where it's needed. Guard the parse: either side with a NaN core returns 0
(not comparable), which callers classify as 'behind' — the safe direction.
Tests at both layers (comparator + versionSkew classification).

Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

Author: coderdan

packages/cli/src/__tests__/runtime-versions.test.ts

@@ -116,6 +116,14 @@ describe('compareVersions', () => {
     expect(compareVersions('1.0.0-rc.1', '1.0.0-rc.1')).toBe(0)
   })
 
+  it('treats a non-numeric core as not comparable (never "ahead")', () => {
+    // A corrupt manifest version must not NaN-poison the order into 1
+    // ("installed is newer") — that would suppress the align guidance.
+    expect(compareVersions('v1.0.0', '1.0.0')).toBe(0)
+    expect(compareVersions('1.0.x', '1.0.0')).toBe(0)
+    expect(compareVersions('garbage', '1.0.0')).toBe(0)
+  })
+
   it('numeric identifiers sort below alphanumeric; shorter below longer', () => {
     expect(compareVersions('1.0.0-1', '1.0.0-alpha')).toBe(-1)
     expect(compareVersions('1.0.0-rc', '1.0.0-rc.1')).toBe(-1)

packages/cli/src/commands/init/steps/__tests__/install-deps.test.ts

@@ -316,6 +316,23 @@ describe('versionSkew', () => {
     expect(versionSkew(['@no-map/package'], {})).toEqual([])
   })
 
+  it('classifies a garbage installed version as behind (align guidance), not ahead', () => {
+    present('@cipherstash/stack')
+    resolvedVersions({ '@cipherstash/stack': 'not-a-version' })
+    expect(
+      versionSkew(['@cipherstash/stack'], {
+        '@cipherstash/stack': '9.9.9-test.1',
+      }),
+    ).toEqual([
+      {
+        pkg: '@cipherstash/stack',
+        installed: 'not-a-version',
+        expected: '9.9.9-test.1',
+        direction: 'behind',
+      },
+    ])
+  })
+
   it('flags an installed package with an unreadable manifest', () => {
     present('@cipherstash/stack')
     resolvedVersions({ '@cipherstash/stack': undefined })

packages/cli/src/runtime-versions.ts

@@ -103,6 +103,12 @@ export function pinnedSpec(
  * metadata — just enough to order the versions this repo publishes
  * (`x.y.z` and `x.y.z-rc.n`), so the skew warning can tell "behind" from
  * "ahead" without adding a dependency to the CLI.
+ *
+ * A version whose core isn't numeric (`v1.0.0`, `1.0.x`, garbage from a
+ * corrupt manifest) is NOT COMPARABLE: return `0` rather than a
+ * NaN-poisoned order. Callers classify non-ahead as behind, so an
+ * unparseable installed version gets the safe treatment (align/reinstall
+ * guidance) instead of being silently promoted to "newer, leave it".
  */
 export function compareVersions(a: string, b: string): -1 | 0 | 1 {
   const parse = (v: string) => {
@@ -114,6 +120,7 @@ export function compareVersions(a: string, b: string): -1 | 0 | 1 {
   }
   const pa = parse(a)
   const pb = parse(b)
+  if (pa.core.some(Number.isNaN) || pb.core.some(Number.isNaN)) return 0
   for (let i = 0; i < 3; i++) {
     const da = pa.core[i] ?? 0
     const db = pb.core[i] ?? 0