feat: implement server versioning approach with semantic versioning support (#296)

This implements the versioning approach agreed upon in issue #158:

## Key Changes

### Documentation
- Added comprehensive versioning guide (docs/versioning.md)
- Updated FAQ with versioning guidance and best practices 
- Enhanced schema description with SHOULD recommendations

### Schema Updates
- Added 255-character limit for version strings in schema.json
- Enhanced version field description with semantic versioning guidance

### Implementation 
- New isSemanticVersion() function for proper semver detection
- Enhanced compareSemanticVersions() with prerelease support
- Implemented compareVersions() strategy:
  * Both semver: use semantic comparison
  * Neither semver: use timestamp comparison
  * Mixed: semver versions always take precedence
- Updated publish logic to determine "latest" using new strategy
- Added version length validation (255 char max)

### Versioning Strategy
1. Version MUST be string up to 255 characters
2. SHOULD use semantic versioning for predictable ordering
3. SHOULD align with package versions to reduce confusion 
4. MAY use prerelease labels for registry-specific versions
5. Registry attempts semver parsing, falls back to timestamp ordering
6. Clients SHOULD follow same comparison logic

Resolves #158

---------

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>

tools/publisher/auth/common.go

@@ -118,4 +118,4 @@ func (c *CryptoProvider) exchangeTokenForRegistry(ctx context.Context, domain, t
 	}
 
 	return tokenResp.RegistryToken, nil
-}
+}

tools/publisher/auth/dns.go

@@ -5,7 +5,8 @@ type DNSProvider struct {
 }
 
 // NewDNSProvider creates a new DNS-based auth provider
-//nolint:ireturn // Factory function returns interface by design
+//
+//nolint:ireturn // Factory function intentionally returns interface for dependency injection
 func NewDNSProvider(registryURL, domain, hexSeed string) Provider {
 	return &DNSProvider{
 		CryptoProvider: &CryptoProvider{

tools/publisher/auth/github-at.go

@@ -63,7 +63,8 @@ type ServerHealthResponse struct {
 }
 
 // NewGitHubATProvider creates a new GitHub OAuth provider
-//nolint:ireturn // Factory function returns interface by design
+//
+//nolint:ireturn // Factory function intentionally returns interface for dependency injection
 func NewGitHubATProvider(forceLogin bool, registryURL string) Provider {
 	return &GitHubATProvider{
 		forceLogin:  forceLogin,

tools/publisher/auth/github-oidc.go

@@ -14,7 +14,9 @@ type GitHubOIDCProvider struct {
 	registryURL string
 }
 
-//nolint:ireturn // Factory function returns interface by design
+// NewGitHubOIDCProvider creates a new GitHub OIDC provider
+//
+//nolint:ireturn // Factory function intentionally returns interface for dependency injection
 func NewGitHubOIDCProvider(registryURL string) Provider {
 	return &GitHubOIDCProvider{
 		registryURL: registryURL,

tools/publisher/auth/http.go

@@ -20,4 +20,4 @@ func NewHTTPProvider(registryURL, domain, hexSeed string) Provider {
 // Name returns the name of this auth provider
 func (h *HTTPProvider) Name() string {
 	return "http"
-}
+}