Validate package version when installing community node

Editor assessment

This commit patches CVE-2026-21893. The header fix(core): Validate package version when installing community node is clear and accurately scoped to core, and it tells the reader exactly which operation gained validation. The only body content is a co-author trailer, so the commit gives no detail on what constitutes a valid version or why the check was added. For a compact validation guard that is a minor shortfall rather than a failure, since the subject alone communicates the behavior change. Footer grammar is correct and nothing overstates the change. Publishable, though a sentence on the rejected inputs would have made it stronger.