fix: validate and match prerelease token prefixes - #489

Version.next_version("prerelease", token) can bypass the existing token validator when a prerelease already exists. rc+build creates fields that differ after parsing the object's own string, and [ raises a regex error. Valid dotted tokens also fail: alpha.beta.1 with token alpha.beta stays unchanged, while alphaXbeta9 falsely matches that token as a regex pattern.

Reuse the existing SemVer identifier validator, match old-style counters literally, and recognize a token family at an identifier boundary. alpha.beta.1 now advances to alpha.beta.2; an unrelated family resets to alpha.beta.1. Existing qualifier chains, legacy rc3, empty/None tokens, token switching, immutable inputs and ignored tokens for major/minor/patch remain supported. Add public regressions and the required pr489.bugfix.rst newsfragment. Dependency, version, native backend, CLI and source workflow configuration are unchanged.

Validation:

• Original tox py312: 488 passed, 1 skipped, 100% coverage on CPython 3.12.13. Unchanged baseline: 471 passed, 1 skipped, 100% coverage. Exact original implementation with the same final next-version regressions: 36 passed, 9 failed.
• Original Python workflow in the fork: all 12 actual Python 3.10–3.15 jobs across Ubuntu and macOS succeed, each with 488 passed and 1 skipped. The original check step still reports 160 Ruff diagnostics and uses its existing continue-on-error: true; baseline and final have no diagnostic delta. The same existing mypy native-import error and 12 Pyright diagnostics are also retained and recorded as failures.
• Source and input reviews approve. Real wheel/sdist each contain 8 package members matching final Git. Independent replay of the retained public helper passes from isolated wheel installs in pure mode and with the actual optional native parser. Native files were copied from an existing installed 0.1.1 distribution after an offline-cache attempt failed; this is recorded explicitly. Both artifacts pass Twine 6.2.0 validation.
• Equivalent Sphinx builds on baseline and final process 44 source files with 0 warnings. Towncrier check and draft pass. The original uvx make documentation wrapper fails on both because the PyPI make package provides no executables; this existing wrapper is outside the diff.
• Fork CodeQL fails with Resource not accessible by integration / configuration error. Its permissions and steps are unchanged. Upstream Python and CodeQL runs require maintainer approval, so upstream checks and review remain pending.