fix: report module version for go install

[fxdv]

Summary

• keep linker-injected release versions authoritative
• fall back to Go build metadata for binaries installed with go install ...@version
• use the same resolved version in --version output and the CLI banner
• keep local and unavailable build metadata on the explicit dev value

Test evidence

• go vet ./...
• go test -ldflags='-linkmode=external' ./... -count=1
• go test -race -ldflags='-linkmode=external' ./pkg/... -count=1
• bash scripts/cross-build.sh
• local binary: patchlog dev
• linker-injected binary: patchlog v0.1.2

Security and operations

The fallback reads only Go's embedded build metadata and performs no filesystem or network access. Release archive builds continue to use the immutable linker-injected tag. The real versioned-module path will be verified after publishing v0.1.2.

Proxy metrics remain diagnostic only and are not release gates.