fix(build): tighten seed regex to exact-version files only

The release-output seed-from-live pattern used `*_v*.html` (glob),
which matches partial-pin filenames (`<tool>_v<X.Y>.html`,
`<tool>_v<X>.html`) as well as exact-version (`<tool>_v<X.Y.Z>.html`).
After bdd1460 dropped partial pins, their .sig files (real files)
were still being carried into new release bundles as orphans because
the partial-pin .html files (symlinks) weren't seeded but the .sig
files were.

Switch to a strict X.Y.Z regex via find -regextype posix-extended.
Same fix on the zddc-server pattern (anchor on `_<platform>` after
the version). For the v0.0.18 bundle that's already cut, the
orphans were cleaned manually before deploy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

build

@@ -130,15 +130,18 @@ if [ "$RELEASE_CHANNEL" = "stable" ]; then
         echo "=== Seeding $RELEASES_DIR from $LIVE_RELEASES (per-version artifacts only) ==="
         rm -rf "$RELEASES_DIR"
         mkdir -p "$RELEASES_DIR"
-        # Copy per-version immutable files + their .sig sidecars. The
-        # canonical <tool>.html / zddc-server_<plat> symlinks will be
-        # rewritten by this cut and old channel/partial-pin files from
-        # the previous layout (if any still live there) will be cleaned
-        # up by deploy's --delete-after rsync.
-        find "$LIVE_RELEASES" -maxdepth 1 -type f \( \
-            -name '*_v*.html' -o \
-            -name '*_v*.html.sig' -o \
-            -name 'zddc-server_v*' \
+        # Copy per-version immutable files + their .sig sidecars only.
+        # Strict X.Y.Z match avoids picking up legacy partial-version
+        # pins (_v<X.Y>, _v<X>) that may still be lying around as
+        # leftover .sig files in /srv/zddc/releases/ from the pre-
+        # simplification layout. The canonical <tool>.html /
+        # zddc-server_<plat> symlinks will be rewritten by this cut;
+        # anything else (channel mirrors, partial pins, retired tools)
+        # gets cleaned by deploy's --delete-after rsync.
+        find "$LIVE_RELEASES" -maxdepth 1 -type f -regextype posix-extended \( \
+            -regex '.*/[a-z-]+_v[0-9]+\.[0-9]+\.[0-9]+\.html' -o \
+            -regex '.*/[a-z-]+_v[0-9]+\.[0-9]+\.[0-9]+\.html\.sig' -o \
+            -regex '.*/zddc-server_v[0-9]+\.[0-9]+\.[0-9]+_.*' \
         \) -exec cp -a '{}' "$RELEASES_DIR/" \;
         # Also seed the public key (it lives at the releases root).
         if [ -f "$LIVE_RELEASES/pubkey.pem" ]; then