Template Registry approval is bypassed by aio templates install/aio app init and pulls latest npm version

[dthampy]

Summary

aio templates install and aio app init install the version from npm’s latest dist-tag, not the version approved in the Template Registry.
The Template Registry’s latestVersion is only used for display in aio templates discover, not for actual installs.
This creates a mismatch where users may see one version (approved) but install a newer, unapproved version.
As a result, publishing to npm effectively bypasses the registry approval gate.

Expected Behavior

aio templates install and aio app init should install the version specified by the Template Registry’s latestVersion (i.e., the approved version).
The Template Registry should act as the source of truth and release gate for template availability.
All CLI flows (discover, install, app init) should consistently use the registry-approved version.

Possible fix

when the install spec has no explicit version (src/commands/templates/install.js → src/lib/npm-helper.js:102), look up the template's latestVersion from the Template Registry (already used by discover.js via getTemplates() in template-registry-helper.js) and pass the version-pinned spec to npm install

[dthampy]

Related ACNA ticket - https://jira.corp.adobe.com/browse/ACNA-4571