fix(cli): substitute @build.version@ when scaffolding from dev checkout (closes #2279)

[bpamiri]

Summary

• wheels new copied vendor/wheels/box.json verbatim from the resolved framework source. When that source was a dev checkout of the wheels-dev/wheels monorepo, the unreplaced @build.version@ placeholder rode along into the scaffolded app. The release pipeline substitutes the placeholder at build time, but raw checkouts do not.
• $readFrameworkVersion()'s dev-fallback only identifies the monorepo when the enclosing box.json is the monorepo's own — a condition never met inside a generated app (its own box.json is the app's, and there's no monorepo root anywhere in its tree). The framework fell through to "0.0.0-dev" and the homepage reported that forever.
• copyFrameworkToVendor now delegates to a new FrameworkInstaller service that post-processes the copied box.json. If the placeholder is still present AND the source's enclosing root box.json identifies the monorepo (slug=wheels or name=Wheels.fw) AND has a real version, the copy's placeholder becomes <rootversion>-dev (e.g. 4.0.0-dev). Released bundles short-circuit — their box.json already carries a real version.

Why a service

Extracted into cli/lucli/services/FrameworkInstaller.cfc so specs can exercise the behavior without instantiating Module.cfc, which requires a modules.BaseModule mapping that only exists at LuCLI runtime. Keeps Module.cfc thin and keeps the test surface well-scoped.

Test plan

• New FrameworkInstallerSpec — 6 specs covering slug match, name match, non-monorepo enclosing box.json, released bundle (real version), both-placeholder pathological case, and missing enclosing box.json. All green.
• Full CLI suite: 442 pass, 0 fail, 0 error (was 436 pre-change; +6 new).
• End-to-end smoke: pointed the installed LuCLI at this branch, ran wheels new issue-2279-test in a temp dir, inspected vendor/wheels/box.json → "version":"4.0.0-dev" (was "@build.version@" before the fix).
• CI: PR fast-gate across Lucee 6/7 + Adobe + BoxLang × database matrix.

Out of scope / follow-ups

• The framework-side default rootBoxJsonPath in $readFrameworkVersion() resolves to vendor/box.json (one level up from vendor/wheels/Global.cfc), not <repo>/box.json two levels up. If the running Wheels dev server also shows 0.0.0-dev at runtime on develop, that's a separate defect in PR fix(view): homepage version and CLI detection (closes #2255, #2259) #2272's default-path math and should be addressed in its own change with a smoke test on the server, not just on the synthetic-fixture unit tests.