Make plugin metadata idempotent by comparing against the base branch

auto_apply_plugin_metadata.py asked "what version is already released?" by
reading the category manifest out of the PR's own working tree. Once
ci-apply.yml has pushed its "[ci] apply-plugin-metadata-and-formatting"
commit back to the PR branch, that tree already lists the version being
added - so the check compared the new version against itself and raised
"Version cant be lower or equal than the previous version."

That fires on every re-run of PR Check: the one ci-apply.yml's own push
triggers, and any run caused by a contributor pushing a follow-up commit.

Published state now comes from the base branch instead, read with
`git show $PLUGMAN_BASE_REF:<manifest>` (ci-check.yml supplies the PR base
sha; local runs fall back to origin/main, then to the working tree). The
writer is idempotent to match: a version entry that is already stamped and
still matches the plugin's md5sum is left alone rather than reset to null.

An entry whose md5sum has drifted is still reset, which implements the TODO
this replaces - a contributor can keep iterating on an unpublished version
during review without bumping it every round. Bump enforcement against
published versions is unchanged.

Version comparison and ordering switch to the existing
get_comparable_version_tuple_from_string; versioning_tools.semantic_to_str
ordered 1.0.10 below 1.0.9 and silently truncated 3-digit components.

.github/workflows/ci-check.yml

@@ -79,7 +79,14 @@ jobs:
               < "${RUNNER_TEMP}/changed_py.z"
           fi
 
+      # PLUGMAN_BASE_REF tells the script which tree counts as "already
+      # published". Without it the script compares against the PR's own
+      # manifest, which ci-apply.yml has already written the new version into -
+      # so every re-run of this workflow (including the one ci-apply.yml's push
+      # triggers) would fail with "Version cant be lower or equal".
       - name: Apply Plugin Metadata (writes null version placeholders)
+        env:
+          PLUGMAN_BASE_REF: ${{ github.event.pull_request.base.sha }}
         run: |
           set -euo pipefail
           python test/auto_apply_plugin_metadata.py "$(cat "${RUNNER_TEMP}/changed_files.txt")"