Fix version numbering: anchor tags set series without triggering release

Two changes:
1. BASE_VERSION now strips pre-release suffixes from the nearest ancestor tag
   (e.g. v2.3.0-pre → 2.3.0), so anchor tags like v2.3.0-pre make feature
   branch builds say 2.3.0-alpha+<sha> without "pre" leaking into the version.

2. Stable release detection changed from glob (refs/tags/v*) to an exact
   semver regex (^refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$). Tags with a suffix
   (v2.3.0-pre, v2.3.0-rc1) build and validate but do not publish to Cloudsmith
   stable — they fall through to the 'none' channel.

This lets us place a v2.3.0-pre anchor tag to version the development series
correctly, then later push v2.3.0 as the actual stable release.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -111,10 +111,14 @@ jobs:
           REF="${{ github.ref }}"
           IS_RELEASE="false"
 
-          # Base version from the nearest vX.Y.Z tag (strips the 'v' prefix)
-          BASE_VERSION="$(git describe --tags --match 'v*' --abbrev=0 2>/dev/null | sed 's/^v//' || echo '0.0.0')"
+          # Base version: nearest ancestor v* tag, stripping the 'v' prefix and any
+          # pre-release suffix (e.g. v2.3.0-pre → 2.3.0). This lets us use anchor
+          # tags like v2.3.0-pre to set the version series without triggering a release.
+          BASE_VERSION="$(git describe --tags --match 'v*' --abbrev=0 2>/dev/null \
+            | sed 's/^v//' | sed 's/[^0-9.].*$//' || echo '0.0.0')"
 
-          if [[ "$REF" == refs/tags/v* ]]; then
+          # Only an exact vX.Y.Z tag (no suffix) is a stable release.
+          if [[ "$REF" =~ ^refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             VERSION="${REF#refs/tags/v}"
             CHANNEL="stable"
             CLOUDSMITH_REPO="truenas-proxmox"