fix: prevent version_read banner from corrupting XML manifests

- Add --quiet flag to version_read.php call in version_auto_bump.php
  so the CliFramework banner doesn't pollute stdout
- Parse version output by matching XX.YY.ZZ pattern instead of
  blindly taking the first line
- Add version format validation in version_set_platform.php to reject
  non-XX.YY.ZZ values before writing to XML files

Root cause: exec() captured the decorative banner output from
version_read.php and version_set_platform.php's regex replacement
injected it into <version> tags across all Joomla manifests.

Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cli/version_auto_bump.php

@@ -109,10 +109,18 @@ class VersionAutoBumpCli extends CliFramework
             echo "{$line}\n";
         }
 
-        // Step 2: Read version
+        // Step 2: Read version (--quiet suppresses banner so only the version is output)
         $versionOutput = [];
-        exec("{$php} {$cli}/version_read.php --path " . escapeshellarg($path) . " 2>&1", $versionOutput, $versionRc);
-        $version = trim($versionOutput[0] ?? '');
+        exec("{$php} {$cli}/version_read.php --path " . escapeshellarg($path) . " --quiet 2>&1", $versionOutput, $versionRc);
+        // Take the last non-empty line — the version is always the final output
+        $version = '';
+        foreach (array_reverse($versionOutput) as $line) {
+            $line = trim($line);
+            if (preg_match('/^\d{2}\.\d{2}\.\d{2}/', $line)) {
+                $version = $line;
+                break;
+            }
+        }
 
         if (empty($version)) {
             echo "No version found — skipping\n";

cli/version_set_platform.php

@@ -53,6 +53,12 @@ class VersionSetPlatformCli extends CliFramework
         // Strip any existing suffix(es) before applying the correct one
         $version = preg_replace('/(-(dev|alpha|beta|rc))+$/', '', $version);
 
+        // Validate version format — must be XX.YY.ZZ to prevent XML corruption
+        if (!preg_match('/^\d{2}\.\d{2}\.\d{2}$/', $version)) {
+            $this->log('ERROR', "Invalid version format: '{$version}' — expected XX.YY.ZZ");
+            return 1;
+        }
+
         // Append stability suffix for non-stable releases
         $stabilitySuffixMap = [
             'stable'            => '',