fix(upgrade.sh): main.yaml sed regex handles semver pre-release tags

[ycpss91255]

Summary

Closes #61.

upgrade.sh line 191-192 used [0-9.]* character class to match the existing @vX.Y.Z reference, which stops at the first non-[0-9.] character. Upgrading from an existing RC tag therefore left the old -rcN suffix in place and appended the new version after it:

# before: @v0.10.0-rc1
# after  ./template/upgrade.sh v0.10.0-rc2
#        @v0.10.0-rc2-rc1   (broken)

ros1_bridge surfaced this when running ./template/upgrade.sh v0.10.0-rc2 from @v0.9.13 — the RC bump produced @v0.10.0-rc2-rc2 and the PR had to manually unglue it before CI could go green.

Fix

Regex anchored on full semver shape per §9:

-sed -i    "s|build-worker\.yaml@v[0-9.]*|build-worker.yaml@${target_ver}|g"
+sed -i -E "s|build-worker\.yaml@v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?|build-worker.yaml@${target_ver}|g"

Same change for release-worker.

Tests

Two regression tests in template_spec.bats:

• upgrade.sh main.yaml sed handles semver pre-release tags (RC → RC) — @v0.10.0-rc1 → @v0.10.0-rc2, asserts no -rc2-rc double suffix remains.
• upgrade.sh main.yaml sed handles stable → stable + RC → stable transitions — mixed @v0.10.0-rc2 + @v0.9.9 → @v0.10.0, asserts rc2 is gone everywhere.

675 → 677 total.

Test plan

• make -f Makefile.ci test local — 677/677 pass
• CI template self-test green
• After merge: include in v0.10.0 stable release so future upgrades from any RC-pinned repo are safe.