fix: fetch updates.xml from main, discard stale version entries

- auto-release: fetch existing updates.xml from main before building
- updates_xml_build: discard preserved entries with versions lower
  than the current release to prevent stale data leaking through

Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.mokogitea/workflows/auto-release.yml

@@ -411,9 +411,13 @@ jobs:
           VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
           SHA256="${{ steps.package.outputs.sha256_zip }}"
 
-          # For stable releases, start with a clean updates.xml
-          # Stable writes ALL channels so no entries need preserving
-          rm -f updates.xml
+          # Fetch latest updates.xml from main so preserve logic has current channels
+          GITEA_TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          curl -sf -H "Authorization: token ${GITEA_TOKEN}" \
+            "${API}/contents/updates.xml?ref=main" 2>/dev/null | \
+            php -r "\$d=json_decode(file_get_contents('php://stdin'),true); echo base64_decode(\$d['content'] ?? '');" \
+            > updates.xml 2>/dev/null || rm -f updates.xml
 
           SHA_FLAG=""
           [ -n "$SHA256" ] && SHA_FLAG="--sha ${SHA256}"

cli/updates_xml_build.php

@@ -491,9 +491,19 @@ if (file_exists($dest)) {
             if (isset($existingUpdate->tags->tag)) {
                 $existingTag = (string) $existingUpdate->tags->tag;
             }
-            // Keep entries for channels we're NOT overwriting
+            $existingVersion = (string) ($existingUpdate->version ?? '');
+            // Strip suffixes for comparison
+            $existingBase = preg_replace('/(-(dev|alpha|beta|rc))+$/', '', $existingVersion);
+            $currentBase = preg_replace('/(-(dev|alpha|beta|rc))+$/', '', $version);
+
+            // Keep entries for channels we're NOT overwriting,
+            // but ONLY if their version is >= current (never preserve stale entries)
             if (!empty($existingTag) && !in_array($existingTag, $writtenChannels, true)) {
-                $preservedEntries[] = '  ' . trim($existingUpdate->asXML());
+                if (version_compare($existingBase, $currentBase, '>=')) {
+                    $preservedEntries[] = '  ' . trim($existingUpdate->asXML());
+                } else {
+                    echo "Discarding stale {$existingTag} entry (v{$existingVersion} < v{$version})\n";
+                }
             }
         }
     }