v1.6.1-rc.4

Full Changelog: v1.6.1-rc.3...v1.6.1-rc.4

[1.6.1-rc.4] — 2026-08-27

Tag suggestion no longer ranks a bare integer build-number tag above a real dotted version. A bare integer tag (e.g. 168) coerces via semver.coerce() into a fake 168.0.0, which previously outranked a real release like 1.43.3 — for linuxserver/plex, this meant the suggested-tag badge and, with a permissive dd.tag.include filter, the actionable update candidate itself could point at a destructive downgrade. Bare integer tags are now only ever ranked among themselves (never against a real dotted version, and never at all when the population contains any other non-integer version signal, such as a prerelease-only or coercion-lossy tag), sorted numerically rather than lexically. The rule is shared between the suggested-tag badge (tag/suggest.ts) and the actionable non-semver/includeTags recovery path (watchers/providers/docker/tag-candidates.ts) via a new tag/version-population.ts module so the two paths can't drift apart again. (#859)

Note: this is a maintenance cut, built from dev/v1.6 at 487db3af3f7d42eae5006d707820ac1b5a9c4fc9, not from main.

The container image and release artifact are cosign-signed (identity release-cut.yml@refs/heads/main, since the workflow run itself always executes at that ref), but carry no SLSA build-provenance attestation — this workflow's own OIDC token always claims main HEAD as the build source, which would be false for this artifact, so attestation is skipped rather than publish a false claim.