Allow development packages to install locked backends

[t-kalinowski]

Summary

• Validate downloaded backend metadata against the artifact package version recorded in the backend catalog.
• Record that version when packaging and merging complete and CPU-only backend catalogs.
• Add regression coverage for installing a released backend from a development package.

Public-facing changes

Development package versions such as 0.4.0.9000 can install the prebuilt GPU and CPU backends pinned by their catalogs. Archive hashes, backend hashes, R versions, platforms, dependency versions, and source commits remain validated.

Internal changes

Backend catalogs now include a package_version column. The cross-version model-state test now uses explicit released-version provenance instead of relying on the frozen fixture version differing from the current package version.

Testing

• CUDA_ML_GPU_TESTS=false Rscript -e 'devtools::test(reporter = "summary")'
• CUDA_ML_GPU_TESTS=false CUDA_ML_CPU_RUNTIME_TESTS=true Rscript -e 'devtools::test(filter = "runtime-functional", reporter = "summary")'
• Clean-cache CPU backend installation and audit from package version 0.4.0.9000
• R CMD check --as-cran --no-manual: 0 errors, 0 warnings, 0 notes