version: retain prerelease suffix in Semver comparisons

[TeoSlayer]

M25 — Updater version pinning ignores prerelease suffix

ParseSemver (version.go:23) discarded everything after the first hyphen, so v1.2.3-rc1 and v1.2.3 parsed to the identical Semver{1,2,3}. Two call sites depended on that value:

• updater.go:231 — latest.NewerThan(current): with v1.2.3-rc1 installed, the real v1.2.3 release compared equal and was never installed.
• updater.go:265 — current == pinned in checkPinnedVersion: an exact pin to v1.2.3 was satisfied by an installed v1.2.3-rc1, and vice versa.

.pilot-version already stores the raw tag (release.TagName), so the suffix was present on disk and only lost at parse time.

Change

• Semver gains a Pre field holding the prerelease identifiers after the first hyphen.
• +build metadata is stripped before parsing (it takes no part in precedence), so v1.2.3+build.7 still equals v1.2.3.
• New Compare implements semver precedence: numeric triple first, then the prerelease suffix, with a suffixed version sorting below the plain release. Identifiers are split on .; all-digit identifiers compare numerically and sort before alphanumeric ones.
• NewerThan delegates to Compare; String round-trips the suffix.

No wire or on-disk format change — the version file contents and the GitHub API shapes are untouched. Semver grows a field, so the in-repo positional composite literals in the tests were updated.

Tests

Table tests extended in zz_test.go / zz_more_test.go:

• TestParseSemver — -dirty, -rc1, -beta.2, +build.7, -rc.1+build.7.
• TestSemverNewerThan — 13 new pairs covering 1.2.3-rc1 < 1.2.3, rc1 < rc2, beta.9 < rc.1, rc.1 < rc.1.1, numeric-before-alphanumeric, and build-metadata equality.
• TestSemverPinEquality (new) — asserts an exact pin only matches the same suffix, mirroring the checkPinnedVersion equality check.

go build ./..., go vet ./... and go test ./... all green.

Base branch note

The task named fix/gh-free-attestation as the base. That branch exists only locally — its commit is already squash-merged into main as 5588eb0 — so this PR is rebased onto and targets main to avoid re-proposing merged work.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!