refactor(version): single-source the version from the root package.json

The Inspector ships as one package with one version, but four client
package.jsons each carried their own `version` and were read at runtime
(cli.ts, tui App.tsx), and core hardcoded a third, stale value (0.20.0) that
the TUI and web actually reported to servers. Consolidate onto the root
package.json as the single source of truth.

- Add core/node/version.ts: shared, Node-only readInspectorVersion() that walks
  up to the root package.json (always shipped in the tarball). 100% covered by a
  new integration test.
- CLI and TUI read the version via the shared reader instead of their own
  manifest; TUI now also passes a real clientIdentity (was falling through to
  the stale core default).
- Drop the `version` field from all four client package.jsons; the root keeps
  the only version. TUI header name/description become local display constants.
- core default client identity: replace the stale 0.20.0 hardcode with a neutral
  0.0.0 placeholder (real clients pass clientIdentity; web will source its
  version from GET /api/config, see #1639).
- Stop shipping clients/cli/package.json and clients/tui/package.json (no longer
  read at runtime) — supersedes the earlier "ship them" fix; update pack:verify
  and the root README packaging invariants accordingly.
- Add core/node/** to the web coverage include so the new module is gated.
- Add the shared-code architecture diagram to the root README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BrihGWcrM9JGRyu41nzZYw

scripts/pack-and-verify.mjs

@@ -125,15 +125,14 @@ if (maps.length > 0) {
 
 // 2b. Runtime files that are easy to omit from the packlist and only fail once
 //     installed: both web artifacts — the prod server runner (build) AND the SPA
-//     (dist) — plus the TUI's package.json, which the TUI bundle reads at
-//     runtime for its header (name/description/version). `clients/web/build` was
-//     previously dropped by the nested .gitignore; `clients/tui/package.json`
-//     was never listed, so the installed TUI crashed on launch.
+//     (dist). `clients/web/build` was previously dropped by the nested
+//     .gitignore. (The version the CLI/TUI report is read from the root
+//     package.json — always shipped — via readInspectorVersion(), so no client
+//     package.json needs to ship; that read is exercised by driving the bin in
+//     step 4.)
 for (const required of [
   "clients/web/build/index.js",
   "clients/web/dist/index.html",
-  "clients/cli/package.json",
-  "clients/tui/package.json",
 ]) {
   if (!tarredPaths.includes(required)) {
     fail(
@@ -179,8 +178,6 @@ try {
     join(installedPkg, "clients", "web", "build", "index.js"),
     join(installedPkg, "clients", "web", "dist", "index.html"),
     join(installedPkg, "clients", "launcher", "build", "index.js"),
-    join(installedPkg, "clients", "cli", "package.json"),
-    join(installedPkg, "clients", "tui", "package.json"),
   ]) {
     if (!existsSync(required)) {
       fail(`expected installed file missing: ${required}`);