Support image revision tags in service updates

[csandanov]

The service updater currently ignores revision tags such as 11.4-r0. Recognize the new aliases, prefer them to legacy tags, and require matching Git and registry tags. Preserve image variants such as PostGIS, compare revision numbers numerically, and avoid rolling a migrated service back to a legacy or older revision tag.

Resolve image change notes through each annotated alias to its repository release, including full-version aliases whose counters reset. Keep legacy lookup for images that have not migrated, including the held Supabase Postgres release. Service and Helm versions remain semantic versions.

Validation: all 33 script tests passed, covering migration, variant selection, missing aliases, numeric ordering, rollback prevention, release-note lookup, and chart version detection. Pull requests now run the maintenance-script tests.

The chart migration is wodby/charts #19. Merge this updater change after the planned service releases so automated patch releases do not race the migration's parent-version pins.

Coordinated service revisions:

Repository	Pull request	Planned release
service-adminer	#4	2.0.7
service-angular	#2	2.0.0
service-django	#3	1.2.9
service-drupal-nginx	#4	2.0.0
service-drupal-php	#8	1.3.8
service-drupal-varnish	#2	1.0.12
service-drupal-vinyl	#2	1.0.13
service-fastapi	#3	1.1.11
service-flask	#3	1.1.11
service-frpc	#3	1.1.4
service-frps	#2	0.1.4
service-go	#6	2.0.0
service-httpd	#5	1.0.11
service-laravel-nginx	#4	2.0.0
service-laravel-php	#6	2.0.8
service-mariadb	#7	2.0.0
service-matomo	#7	2.0.8
service-matomo-nginx	#4	2.0.0
service-memcached	#2	1.0.4
service-mysql	#3	2.0.1
service-nextjs	#2	2.0.0
service-nginx	#8	2.0.0
service-nginx-proxy	#4	1.0.0
service-node	#3	2.0.0
service-openclaw	#2	1.0.9
service-opensmtpd	#2	1.0.9
service-php	#6	3.0.0
service-php-httpd	#2	1.0.11
service-php-nginx	#2	2.0.0
service-postgis	#2	1.0.17
service-postgres	#11	1.2.2
service-prometheus	#3	1.0.10
service-python	#4	1.0.12
service-rabbitmq	#3	1.0.10
service-rails	#3	1.3.7
service-react	#2	2.0.0
service-redis	#2	2.0.0
service-ruby	#4	1.1.9
service-slack-inviter	#2	2.0.8
service-solr	#3	1.1.4
service-valkey	#2	1.0.10
service-varnish	#4	1.0.13
service-vinyl	#4	1.0.14
service-vue	#2	2.0.0
service-wordpress-nginx	#4	2.0.0
service-wordpress-php	#6	2.0.8
service-wordpress-varnish	#2	1.0.12
service-wordpress-vinyl	#2	1.0.13
service-zookeeper	#3	1.0.8

Publish charts first, then base services, then their inherited services in the dependency order listed in each PR. Service releases that remove selectable versions use a new major version. Merge this updater PR last. Supabase Postgres remains on its existing image tag while the remediation issue is open.