A-C5: mesh-build-node builds against the latest published SDK, the toolchain pins none

Recovered from cfee5f2d (feat/47-G-buildmods).
Builds: design 47 G §571 (the build writes a mesh package's lock entry from the latest published version), A-56

Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h

modules/mesh-build-node/cmd/mesh-build-node/fetch_test.go

@@ -97,7 +97,7 @@ func TestAModuleNamingOnlyTheSdkAndTypesInstallsNothing(t *testing.T) {
 }
 
 // 1489/AC2: a module naming lodash with a lock gets npm ci --omit=dev --ignore-scripts (fake runner), its install put
-// at its node_modules without the SDK and without any copy of it; without a lock the step fails naming the directory.
+// at its node_modules without the install's SDK or any copy of it; without a lock the step fails naming the directory.
 func TestAModuleNamingLodashWithALockIsInstalledWithoutTheSdkAndWithoutALockFails(t *testing.T) {
 	files := typeScriptModule(`{"dependencies":{"@novox/mesh-sdk":"^0.1.6","lodash":"^4"},"devDependencies":{"x":"1"},"scripts":{"test":"y"}}`)
 	files["modules/m/package-lock.json"] = `{"lockfileVersion":3}`
@@ -119,7 +119,8 @@ func TestAModuleNamingLodashWithALockIsInstalledWithoutTheSdkAndWithoutALockFail
 	if _, err := os.Stat(filepath.Join(nm, "lodash", "index.js")); err != nil {
 		t.Errorf("lodash is not at the module's node_modules: %v", err)
 	}
-	for _, gone := range []string{"@novox/mesh-sdk", "a/node_modules/@novox/mesh-sdk"} {
+	// The install's copies are gone; the one at the top is the latest release placed after it (placeSDK).
+	for _, gone := range []string{"@novox/mesh-sdk/index.js", "a/node_modules/@novox/mesh-sdk"} {
 		if _, err := os.Stat(filepath.Join(nm, gone)); err == nil {
 			t.Errorf("a copy of the SDK is left at %s", gone)
 		}