Semver: handle prerelease comparison

`semver_sort_key` (in `translator._semver_sort_key_expr`) extracts the first three digit-runs from the version string, zero-pads each to 10 chars, and joins with dots. This gives correct major.minor.patch ordering but ignores prerelease: `1.2.3-beta` and `1.2.3` produce the same key.

Per [semver spec](https://semver.org/#spec-item-11), `1.2.3-beta < 1.2.3` (prerelease versions compare *less than* the corresponding release). My current implementation gets this wrong.

## What to ship

Extend the sort key with a prerelease tail. Approximation that's good enough for behavioural-targeting use:

- Extract everything after `-` (and before any `+` build metadata) as the prerelease string.
- Append a sentinel: `'~'` for absent prerelease (sorts after any prerelease alphabetically — `~` is high-ASCII), the literal prerelease string otherwise.
- Per-dot-segment numeric prerelease comparison is a further refinement (engine semver lib does this); skip for v1.

## Why deferred

Smoke-tested at 23/24 parity in the PoC; the one mismatch was the prerelease case described above. Customer segments using semver tend to use clean major.minor.patch (`app_version: "2.5.10"`) without prerelease tails. Will revisit if a customer reports an unexpected match for a `-beta` version.