The `versioning: loose` package rule matched roles via `matchSourceUrls`.
For `git-tags` dependencies, `sourceUrl` only becomes known after the
datasource lookup, but Renovate resolves the versioning API before that
and never re-resolves it. The rule therefore never applied and roles
fell back to `semver-coerced`, which strips the `-N` suffix, so
`v1.0.0-9` and `v1.0.0-12` compared as equal and no update was offered.

Since the self-hosted runner took over (2026-08-30), only `-0` bumps
have been merged. A local dry-run of renovate 44.61.6 against the
current requirements.yml finds 1 update with the old rule and 9 with
this one (8 of them `-N` bumps).

Same fix as mother-of-all-self-hosting/mash-playbook@a38bae238d7eea364e9c2dbdb788fca095bc47d6
Related to https://github.com/mother-of-all-self-hosting/mash-playbook/issues/3395

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Co-authored-by: mdad-renovate[bot] <322784800+mdad-renovate[bot]@users.noreply.github.com>