versionExists npm terminal failures

Trap: treating any unsuccessful npm response as version-not-found, or accepting malformed HTTP 200 metadata, looks convenient but hides registry failures and may start npm, pnpm, Bun, or Yarn with an untrusted target. Fix: return false only for 404, return true only for valid success metadata, and throw UpgradeError("network_error") for other statuses or the strict invalid-metadata error for malformed success; terminal probes must start no subprocess.