fix(dep-versions): 直接读取 node_modules/<dep>/package.json，不再依赖 require.resolve

CI（bun 1.4.0）上 detectHermesEnabled 的 RN 版本用例失败：带 paths 的
require.resolve 结果被按 specifier 缓存，第二个临时项目解析到了第一个项目
的 react-native。改为从 cwd 向上查找 node_modules/<dep>/package.json 直接读取，
不受解析器缓存影响；同时对 exports 映射未导出 package.json 的依赖也能取到版本
（require.resolve 在这种包上会抛错而被静默跳过）。

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tusm6iL2itjJZDiemujAeL

Author: luoqingming

src/utils/dep-versions.ts

@@ -35,15 +35,31 @@ function directDependencyNames(pkg: ProjectPackageJson): string[] {
   ];
 }
 
-/** version of the installed copy of `dep`, resolved from `cwd` */
+/**
+ * Version of the installed copy of `dep`: the nearest
+ * `node_modules/<dep>/package.json` from `cwd` upwards, read directly. Not
+ * `require.resolve`: a package whose `exports` map omits package.json makes
+ * it throw, and bun caches its answer per specifier, ignoring `paths`.
+ */
 function readInstalledVersion(dep: string, cwd: string): string | undefined {
-  try {
-    const packageJsonPath = require.resolve(`${dep}/package.json`, {
-      paths: [cwd],
-    });
-    return require(packageJsonPath).version;
-  } catch {
-    return undefined;
+  let dir = path.resolve(cwd);
+  for (;;) {
+    try {
+      const pkg = JSON.parse(
+        fs.readFileSync(
+          path.join(dir, 'node_modules', dep, 'package.json'),
+          'utf8',
+        ),
+      ) as { version?: unknown };
+      return typeof pkg.version === 'string' ? pkg.version : undefined;
+    } catch {
+      // not installed at this level
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) {
+      return undefined;
+    }
+    dir = parent;
   }
 }