[bugfix] repo:install-and-deploy: use the resolved version for the classpath too

The previous commit deployed the explicitly-requested version but still drove
ClasspathHelper.updateClasspath() (and the install status/action reporting) from
installPackage()'s return value, which can be packages.latest() -- a higher
already-installed version. So repo:install-and-deploy(name, "<older>", url)
deployed the older version's XQuery resources while loading the newer version's
Java JARs onto the classpath, a silent version mismatch.

Resolve the deploy target once (resolveInstalledVersion) before the classpath
update and use it for BOTH the classpath update and the deploy, so they always
act on the same package version. Also treat an empty @Version (the DOM
getAttribute returns "" not null for a versionless descriptor) as "no specific
version requested", and drop a redundant Packages import already covered by the
package wildcard.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ThoADnh6VvDt5w8kz7d2d3

Author: joewiz

exist-core/src/main/java/org/exist/repo/Deployment.java

@@ -46,7 +46,6 @@
 import org.exist.xquery.value.SequenceIterator;
 import org.exist.xquery.value.Type;
 import org.expath.pkg.repo.Package;
-import org.expath.pkg.repo.Packages;
 import org.expath.pkg.repo.*;
 import org.expath.pkg.repo.deps.DependencyVersion;
 import org.expath.pkg.repo.tui.BatchUserInteraction;
@@ -246,24 +245,26 @@ public Optional<String> installAndDeploy(final DBBroker broker, final Txn transa
             LOG.info("Installing package {}", xar.getURI());
             final UserInteractionStrategy interact = new BatchUserInteraction();
             final org.expath.pkg.repo.Package pkg = repo.get().getParentRepo().installPackage(xar, true, interact);
-            final ExistPkgInfo info = (ExistPkgInfo) pkg.getInfo("exist");
+
+            // installPackage may return packages.latest() (the highest-version entry by semver)
+            // rather than the just-installed package when the registry already had a higher version
+            // with the same name. Resolve the freshly-installed package specifically (looked up by
+            // the version we extracted from the XAR descriptor above) and use it for BOTH the
+            // classpath update and the deploy below, so an explicit
+            // repo:install-and-deploy(name, "<older>", url) is not silently upgraded to
+            // packages.latest() -- and its Java module JARs are not loaded from the wrong (higher)
+            // version's package.
+            final Package deployTarget = resolveInstalledVersion(repo.get(), pkg, pkgVersion);
+            final ExistPkgInfo info = (ExistPkgInfo) deployTarget.getInfo("exist");
             if (info != null && !info.getJars().isEmpty()) {
-                ClasspathHelper.updateClasspath(broker.getBrokerPool(), pkg);
+                ClasspathHelper.updateClasspath(broker.getBrokerPool(), deployTarget);
             }
             broker.getBrokerPool().getXQueryPool().clear();
-            final String pkgName = pkg.getName();
+            final String pkgName = deployTarget.getName();
             // signal status
-            broker.getBrokerPool().reportStatus("Installing app: " + pkg.getAbbrev());
-            repo.get().reportAction(ExistRepository.Action.INSTALL, pkg.getName());
-
-            // installPackage may return packages.latest() (the highest-version
-            // entry by semver) rather than the just-installed package when the
-            // registry already had a higher version with the same name. Deploy
-            // the freshly-installed package specifically (looked up by the
-            // version we extracted from the XAR descriptor above) so an explicit
-            // repo:install-and-deploy(name, "<older>", url) is not silently
-            // upgraded to packages.latest().
-            final Package deployTarget = resolveInstalledVersion(repo.get(), pkg, pkgVersion);
+            broker.getBrokerPool().reportStatus("Installing app: " + deployTarget.getAbbrev());
+            repo.get().reportAction(ExistRepository.Action.INSTALL, deployTarget.getName());
+
             LOG.info("Deploying package {} (version {})", pkgName, deployTarget.getVersion());
             return deploy(broker, transaction, deployTarget, null);
         }
@@ -283,7 +284,10 @@ private void checkProcessorVersion(final PackageLoader.Version version) throws P
     }
 
     private Package resolveInstalledVersion(final ExistRepository repo, final Package installed, final String requestedVersion) {
-        if (requestedVersion == null) {
+        // requestedVersion comes from the XAR descriptor's @version, which is "" (not null) when the
+        // descriptor declares no version -- in that case there is no specific version to honor, so
+        // fall back to the freshly-installed package.
+        if (requestedVersion == null || requestedVersion.isEmpty()) {
             return installed;
         }
         final Packages allVersions = repo.getParentRepo().getPackages(installed.getName());