fix(versioncheck): pick semver-max instead of first stable tag

cmd/versioncheck was treating LatestTags() as ordered newest-first
and taking the first stable entry. Three of the registries don't
honor that:

- Docker Hub sorts by tag_last_pushed, so a late patch on an old
  branch ranks above the real latest (bitcoin: v27.2 ahead of v28.0)
- GHCR and OCI v2 tags/list don't define order at all

Net effect: ~12 chains were silently marked "up to date" against a
fake latest (bitcoin, bsc, cardano, cosmos, harmony, klaytn, opbnb,
mantle, ton, goat, gravity-alpha, etc.). Mostly harmless for now
because the real latest is genuinely newer, but it hides real
updates behind false confidence.

Added registry.Newest() — picks semver-max from a slice, skipping
unparseable tags. Caller still strips pre-releases first. Updated
checkVersions to collect all stable tags into a slice and call
Newest(), instead of break-on-first.

Re-running cmd/versioncheck shows the expected fixes:
- bitcoin   v28.0 -> v28.0 (was v27.2)
- ton       v2026.02-1 -> v2025.03 (was v2024.08)
- gravity-alpha v3.6.8 -> v3.6.8 (was v2.3.3)
- cosmos    v27.0.0 -> v25.2.0 (was v19.0.0)
- opbnb     v0.5.2 -> v0.4.1 (was v0.2.0)
- goat      v0.4.2 -> v0.4.2 (was v0.1.0)

Some chains still report a too-old latest (harmony, bsc 1.3 vs real
1.6.x) — those are pagination issues in the registry clients, the
real latest just isn't in the first 50 tags Docker Hub returns.
That's a separate fix.

Also narrowed .gitignore "versioncheck" -> "/versioncheck" so the
pattern matches only the root-level compiled binary, not the
cmd/versioncheck/ source dir (git refused to add main.go otherwise).

Context: traced bitcoin's "up to date v28.0 vs v27.2" output back
to checkVersions(); read internal/registry/{client,dockerhub,ghcr,
oci}.go to confirm none of them sort by semver; added 6 test cases
for Newest including CalVer (TON-style v2026.02), prefix stripping,
and unparseable-tag skipping. ~45 min total.

Author: tazhate

.gitignore

@@ -41,7 +41,7 @@ cover.out
 testbin/
 
 # Compiled binaries (use bin/ for build artifacts)
-versioncheck
+/versioncheck
 
 # Logo lives in assets/, not in repo root
 /logo.png

cmd/versioncheck/main.go

@@ -144,14 +144,19 @@ func checkVersions(
 				return
 			}
 
-			// Pick the latest stable tag (skip pre-releases, nightly, latest, etc.)
+			// Collect all stable tags, then pick the semver-max — registries
+			// don't guarantee ordering (Docker Hub sorts by last_pushed, which
+			// can rank a stale patch above a real major release).
+			stable := make([]string, 0, len(tags))
 			for _, t := range tags {
 				if isStableTag(t.Tag, it.policy.TagPrefix) {
-					res.LatestTag = t.Tag
-					res.IsNewer = registry.IsNewer(res.LatestTag, res.CurrentTag, it.policy.TagPrefix)
-					break
+					stable = append(stable, t.Tag)
 				}
 			}
+			if latest := registry.Newest(stable, it.policy.TagPrefix); latest != "" {
+				res.LatestTag = latest
+				res.IsNewer = registry.IsNewer(res.LatestTag, res.CurrentTag, it.policy.TagPrefix)
+			}
 
 			mu.Lock()
 			results = append(results, res)

internal/registry/semver.go

@@ -36,6 +36,23 @@ func IsNewer(candidate, current, prefix string) bool {
 	return semver.Compare(c, cur) > 0
 }
 
+// Newest returns the tag from the slice that is greatest by semver under the
+// given prefix. Tags that fail semver parsing are skipped. Returns "" if no
+// candidate parses successfully. Callers should pre-filter pre-releases /
+// floating tags before passing tags in.
+func Newest(tags []string, prefix string) string {
+	best := ""
+	for _, t := range tags {
+		if !semver.IsValid(normalizeTag(t, prefix)) {
+			continue
+		}
+		if best == "" || IsNewer(t, best, prefix) {
+			best = t
+		}
+	}
+	return best
+}
+
 // normalizeTag strips prefix, ensures a leading "v", and pads to vMAJOR.MINOR.PATCH
 // to satisfy golang.org/x/mod/semver strict validation (no leading zeros, 3 parts).
 func normalizeTag(tag, prefix string) string {

internal/registry/semver_test.go

@@ -41,6 +41,55 @@ func TestIsNewer(t *testing.T) {
 	}
 }
 
+func TestNewest(t *testing.T) {
+	cases := []struct {
+		name   string
+		tags   []string
+		prefix string
+		want   string
+	}{
+		{
+			name: "registry returns mixed order picks max",
+			tags: []string{"v27.2", "v28.0", "v27.1", "v26.5"},
+			want: "v28.0",
+		},
+		{
+			name: "CalVer year-month",
+			tags: []string{"v2024.08-1", "v2026.02-1", "v2025.06-1"},
+			want: "v2026.02-1",
+		},
+		{
+			name:   "with prefix",
+			tags:   []string{"GreatVoyage-v4.8.0", "GreatVoyage-v4.8.1", "GreatVoyage-v4.7.9"},
+			prefix: "GreatVoyage-",
+			want:   "GreatVoyage-v4.8.1",
+		},
+		{
+			name: "skips garbage tags",
+			tags: []string{"nightly", "v1.2.3", "stable"},
+			want: "v1.2.3",
+		},
+		{
+			name: "empty input",
+			tags: nil,
+			want: "",
+		},
+		{
+			name: "all invalid",
+			tags: []string{"foo", "bar"},
+			want: "",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := Newest(tc.tags, tc.prefix)
+			if got != tc.want {
+				t.Errorf("Newest(%v, %q) = %q, want %q", tc.tags, tc.prefix, got, tc.want)
+			}
+		})
+	}
+}
+
 func TestNormalizeTag(t *testing.T) {
 	cases := []struct {
 		tag, prefix, want string