CLI: --version reports the npm package version (#731)

* CLI: --version reports the npm package version

npx impeccable --version printed 3.6.0 after the 4.0.0 release because
the shim handed every argument to the engine, whose baked-in
CLI_VERSION still said 3.6.0. The shim now answers --version and -v
from its own package.json, as docs/CLI-CONTRACT.md specifies, without
locating or downloading a binary; a test covers both flags. The
engine's CLI_VERSION moves to 4.0.0 for the next engine release, with
the cli-version golden re-recorded and the delta noted.

Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY

* CLI shim: --version wins whenever it leads, trailing arguments or not

Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY

---------

Co-authored-by: Claude Code <noreply@anthropic.com>

tests/cli-shim.test.mjs

@@ -174,6 +174,17 @@ describe('npm shim download verification', { skip: process.platform === 'win32'
     assert.deepEqual(cacheEntries(res.home), []);
   });
 
+  it('answers --version and -v from its own package.json without touching a binary', async () => {
+    const expected = JSON.parse(fs.readFileSync(PKG_PATH, 'utf-8')).version;
+    for (const args of [['--version'], ['-v'], ['--version', 'extra']]) {
+      const flag = args.join(' ');
+      const res = await runShim(args);
+      assert.equal(res.status, 0, `${flag} exits 0`);
+      assert.equal(res.stdout, `${expected}\n`);
+      assert.deepEqual(requests, [], 'no download was attempted');
+    }
+  });
+
   it('prefers IMPECCABLE_BIN and never downloads', async () => {
     sidecar = { status: 404, body: '' };
     const { dir, shim } = stageShim();