test(acp): pin that the latest install spec stays readable downstream

The latest channel introduces a `<pkg>@latest` spec shape, and the spec —
not the agent type — is what npm_package_requires_scripts and
version_from_package_spec key off. Lock both: hermes-agent keeps its
lifecycle-script override on either attempt, and the `latest` tag is never
mistaken for a version number.