Bazel version stamping can select an unrelated tag on multi-tag release commits

Problem

tools/workspace_status.sh for the Rust services derives STABLE_VERSION from:

git describe --tags --exact-match HEAD

In this monorepo a single release commit normally carries tags for several services and Helm stacks at once. git describe --exact-match returns an arbitrary one of them, so the value stamped as a service's version can belong to a completely different component.

Concretely, on the two most recent function-autoscaler release commits the unfiltered lookup returns a deploy/stacks/nvcf-compute-plane/... chart tag rather than the autoscaler's own tag. One of those commits carries 18 tags.

Because .bazelrc wires this script in via build --workspace_status_command=tools/workspace_status.sh, it affects every stamped Bazel build of these services, not just manual image pushes.

Impact

STABLE_VERSION flows into CARGO_PKG_VERSION via rustc_env_files, and the services report env!("CARGO_PKG_VERSION") as the OpenTelemetry service.version resource attribute. So a build that falls back to the tag path can report another component's version in tracing.

A second, smaller issue: even when the correct tag is selected, the full tag path is used verbatim, so the version would be stamped as src/control-plane-services/function-autoscaler/v1.18.5 instead of 1.18.5.

Affected

• src/control-plane-services/function-autoscaler/tools/workspace_status.sh
• src/invocation-plane-services/http-invocation/tools/workspace_status.sh

Proposed fix

Match only tags belonging to the service (including the legacy prefix where one exists), select the highest matching version, and strip the prefix so the stamped value is a bare semver. Leave the NVCF_VERSION override and the dev fallback behavior unchanged.

Start with the two affected tools/workspace_status.sh files and the .bazelrc workspace_status_command wiring. Inspect how each script currently derives STABLE_VERSION, then verify tag matching and version selection against the multi-tag release commits described in the issue. Done means service-specific highest-version tags produce a bare semver while NVCF_VERSION overrides and development fallback behavior remain unchanged.