[pablocampogo]

Summary

The auto-updater previously assumed a repo published a single kind of release. In a repo that ships both core (CLI) and plugin releases, the plugin stream could pick up the wrong release, and nothing enforced that versions only move forward. This PR makes plugin selection deterministic via a dedicated rolling tag and adds a per-stream monotonic version gate. Core release output (tags, names, assets, checksums) is intentionally unchanged.

Changes

Plugin release workflows (.github/workflows/release-plugin-*.yml)

• Each plugin release now also publishes/updates a single rolling release under the fixed tag latest-plugin, reusing the same assets. The actual version is embedded in the release name (e.g. plugin-go-v1.0.0) so freshness is still discoverable via the API.
• The original per-version release (e.g. plugin-go-v1.0.0) is retained unchanged, so validators still on the old auto-updater keep working while they're migrated.
• Added make_latest: false to the per-version release step so the repo's "Latest" badge stays on the newest core release rather than being stolen by a plugin release.

Auto-updater (cmd/auto-update/releaser.go)

• Split release lookup into a CLI path and a plugin path. The CLI path is unchanged (still scans the release list and filters by asset name).
• The plugin path now fetches the rolling tag directly — GET /repos/{owner}/{repo}/releases/tags/latest-plugin — and reads the version from the release name instead of scanning/guessing across all releases. Added a pluginReleaseTag constant and a Name field on the release struct. The existing ShouldUpdate/semver comparison is reused as-is.

Version gate (cmd/scripts/semver/main.go)

• Added a --stream core|plugin flag. When set, the script enforces that the incoming version is strictly greater than the current released version for that stream:
  • core compares against /releases/latest (the core tag).
  • plugin compares against the latest-plugin release name.
• A 404 (no prior release) is treated as "allowed" so the first release of a stream passes. Version normalization tolerates input with or without a leading v. Without --stream the script stays fully offline, so the frontend build is unaffected.
• Wired --stream + GITHUB_TOKEN into the validate steps of the core (release.yml) and all plugin workflows.

Compatibility

• Core tag/name/asset/checksum output is unchanged.
• Already-deployed updaters keep functioning via the retained per-version plugin releases.

Testing

• go test ./cmd/auto-update/... ./cmd/scripts/semver/...
• Added plugin fetch-by-tag + embedded-version tests, and semver monotonic-gate tests (mocked GitHub API). Core updater tests unchanged.