fxconfig: namespace update always aborts with MVCC_CONFLICT once the channel config has changed (hardcoded _meta NsVersion)

## Summary

`tools/fxconfig/internal/transaction/namespace.go` builds the `_meta` write with a hardcoded `NsVersion: 0` — the `// TODO: we need the correct version of the metaNamespaceID` right above it acknowledges this. Verified present on `main` as of 2026-08-18.

In practice the `_meta` namespace version advances together with the channel config version (each committed config/member update increments it). As a result, on any network that has performed at least one config update (e.g. registering business signing identities into a party's MSP known certs), **`fxconfig namespace update` always fails with `ABORTED_MVCC_CONFLICT`**, regardless of the `--version` flag value (that flag only controls the policy row's read version, which is not the failing check).

## Reproduction (live, Fabric-X 4-party network)

1. Bootstrap, create namespace (`version 0`), then commit two config updates (channel `_config` row at version 2).
2. `fxconfig namespace update --policy=... --version=0` → `ABORTED_MVCC_CONFLICT`. Same with `--version=1`/`2` — the flag is unrelated.
3. Take the tx JSON produced by `namespace update --output`, set `namespaces[0].ns_version` to the current `_config` version (2), regenerate the txID, endorse and submit → **COMMITTED**, policy row advances 0 → 1 as expected.

## Suggested fix

Resolve the `_meta` namespace's actual version before building the transaction (the same lookup the committer's verifier uses), keeping `create` on its current path.

## Side note

On retry after an abort, the regenerated tx has the same content-derived TxID and is then rejected with `REJECTED_DUPLICATE_TX_ID`; a retry should re-randomize the ID. Possibly related to the robustness themes in #197/#189.

Start in tools/fxconfig/internal/transaction/namespace.go, read the _meta namespace write and the committer verifier's version lookup referenced by the issue. Reproduce the update after a channel config change and verify the transaction uses the current _meta version while namespace create keeps its existing path. Confirm that updates commit and the policy row advances as expected.

Written by the indexing model from the issue text.