codemod iterations - #2386

The shebang capture/restore in runner.ts is a user-facing bugfix to the published `@modelcontextprotocol/codemod` package, but the PR ships no `.changeset/*.md` entry, so the fix won't produce a version bump or reach npm consumers. Adding a patch changeset for `@modelcontextprotocol/codemod` (as #2383 did for the previous codemod fix) would let this ship; the batch-test harness changes are dev-only and don't need one.

`parseNpmViewVersion` returns `parsed.at(-1)` with the comment "highest match for a range", but `npm view <pkg>@<range> version --json` returns matching versions in publish order, not semver order — so this picks the most-recently-published match, which is lower than the highest whenever a backport is published after a newer matching release. The mis-resolved version would flow into the results-dir label, `summary.json`, and the pinned versions when `--sdk-version` is a range; a small semver sor

Step 4 of the "How it works" list still unconditionally says the codemod "runs ... using the programmatic API", but with the new `--codemod=published` mode it is instead executed by shelling out to the published CLI via `npx` (`runCodemod()` in `batchTest.ts`). Consider qualifying step 4 the same way step 5 was qualified for the `--sdk` split, e.g. "using the programmatic API (`--codemod=local`, the default) or the published CLI via `npx` (`--codemod=published`)".