fix(install): validate semver format after version fetch to prevent 404 on malformed fallback