install cli@ prerelease flags

Trap: selecting the first stable-looking cli@X.Y.Z tag in packages/cli/install looks safe because prereleases usually contain a suffix, but GitHub may mark a stable-looking tag as prerelease or draft. Fix: parse release objects and require both flags to be false before accepting tag_name, matching the TypeScript resolver; test a flagged cli@X.Y.Z before a valid stable release.