[BryanFRD]

Tag lookups accepted any tag starting with the package prefix, so tags like vendor-sync or core-utils-1.0.1 (prefix core-) cut the prerelease commit range and the missed-release touch check.

The prefix match now also requires the remainder to be a dotted numeric version (optional v, prerelease/build suffix allowed). Tests cover both repros and confirm pkg-v1.1.0-beta.1 still counts.

Closes #1342

[ferrfleet-interne]

Approve. is_version_tag correctly rejects prefix-sharing tags (vendor-sync, core-utils-1.0.1) in the TagIndex lookups and prefixed_tags, and it accepts the formats the versioning strategies emit (semver, calver, sequential, v-prefixed, pre-release). The three new tests in src/git/tests.rs cover the main cases. Two other prefix matchers still use plain starts_with, so the ambiguity is not fully gone.

Findings (both minor, not inline)

• minor, src/monorepo/util.rs:8: tags_for_package filters with t.starts_with(prefix). For prefix core- it still returns core-utils-1.0.1. It feeds impact, cascade, version_hook, upgrade (effective_versioning detection) and why, so those paths can still pick up a sibling package's tags. Fix: make is_version_tag pub(crate) (re-export from crate::git) and use .filter(|t| is_version_tag(t, prefix)).
• minor, src/rollback/mod.rs:71: tag_owner uses tag.starts_with(&prefix) with .next(), so core-utils-1.0.1 is claimed by core if it is listed first. A narrowed rollback can then target the wrong package. Fix: use is_version_tag(tag, &prefix).

Formal verification: the step failed and returned no result, so nothing was verified formally.