[Robustness] install.sh, nvm uninstall: pass the version to grep with -e

`install_nvm_from_git` passed `$NVM_INSTALL_VERSION` to grep as a bare argument,
and `nvm uninstall` did the same with the resolved version when looking for aliases that point to it,
so a value starting with `-` would have been parsed as grep options rather than as the pattern.
Neither value crosses a trust boundary
(the first is the user's own environment variable, and the second is an already-installed version, which never starts with `-`),
but every grep that receives a version should put it after `-e`,
which POSIX specifies and which nvm.sh already uses elsewhere

Discovered by Anthropic's OSS Scanner, alongside vulnerability ANT-2026-EN9DM7WC; this change is not itself a vulnerability fix.

install.sh

@@ -157,7 +157,7 @@ install_nvm_from_git() {
   NVM_VERSION="${NVM_INSTALL_VERSION:-$(nvm_latest_version)}"
   if [ -n "${NVM_INSTALL_VERSION:-}" ]; then
     # Check if version is an existing ref
-    if command git ls-remote "$(nvm_source "git")" "$NVM_VERSION" | nvm_grep -q "$NVM_VERSION" ; then
+    if command git ls-remote "$(nvm_source "git")" "$NVM_VERSION" | nvm_grep -q -e "$NVM_VERSION" ; then
       :
     # Check if version is an existing changeset
     elif ! nvm_download -o /dev/null "$(nvm_source "script-nvm-exec")"; then

nvm.sh

@@ -4741,7 +4741,7 @@ nvm() {
       nvm_echo "${NVM_SUCCESS_MSG}"
 
       # rm any aliases that point to uninstalled version.
-      for ALIAS in $(nvm_grep -l "${VERSION}" "$(nvm_alias_path)"/* 2>/dev/null); do
+      for ALIAS in $(nvm_grep -l -e "${VERSION}" "$(nvm_alias_path)"/* 2>/dev/null); do
         nvm unalias "$(command basename "${ALIAS}")"
       done
     ;;