fix: prevent stale rolling tags when refreshing older patch releases

[Copilot]

Refreshing images for an older release (e.g. v3.18.0) would overwrite rolling tags 3 and 3.18 even if v3.19.0 had already been published, causing those tags to regress to an older fcli version.

Changes

New step: Check whether rolling semantic tags should be published (in generate-metadata)

• Uses skopeo list-tags to fetch all published tags for the target image
• Compares existing X.Y.* and X.*.* tags against the version being built using sort -V
• Sets publish_minor_tag / publish_major_tag to true only when the current version is ≥ the highest published patch in that series
• Defaults both to true (with a ::warning:: annotation) when the registry is unreachable or the image has no tags yet
• Short-circuits to false/false for non-semantic versions (dev_*)

Two new job outputs on generate-metadata

publish_major_tag, publish_minor_tag — consumed by the tags step below.

docker-linux tags generation step

X.Y and X rolling tags are now emitted conditionally:

if [[ "${{ needs.generate-metadata.outputs.publish_minor_tag }}" == "true" ]]; then
  TAGS="${TAGS},${{ env.IMAGE_NAME }}:${MAJOR}.${MINOR}${SUFFIX}"
fi
if [[ "${{ needs.generate-metadata.outputs.publish_major_tag }}" == "true" ]]; then
  TAGS="${TAGS},${{ env.IMAGE_NAME }}:${MAJOR}${SUFFIX}"
fi

Immutable X.Y.Z and X.Y.Z-timestamp tags are always emitted, unchanged.