fix(tools): use matching-refs API for prefix-filtered tag lookups

When a prefix is provided, get_latest_gh_tag now uses the GitHub
matching-refs API (/git/matching-refs/tags/<prefix>) for server-side
filtering. This fixes repos with 100+ tags (e.g. mongodb/mongo-tools
with 463 tags) where the relevant tags were beyond page 1 and never
found by the old tags?per_page=100 approach.

misc/tools.func

@@ -2008,6 +2008,8 @@ verify_gpg_fingerprint() {
 #   0 on success (tag printed to stdout), 1 on failure
 #
 # Notes:
+#   - When a prefix is given, uses the matching-refs API for server-side
+#     filtering (avoids pagination issues with repos that have 100+ tags)
 #   - Skips tags containing "rc", "alpha", "beta", "dev", "test"
 #   - Sorts by version number (sort -V) to find the latest
 #   - Respects GITHUB_TOKEN for rate limiting
@@ -2021,11 +2023,21 @@ get_latest_gh_tag() {
   [[ -n "${GITHUB_TOKEN:-}" ]] && header_args=(-H "Authorization: Bearer $GITHUB_TOKEN")
 
   local http_code=""
+  local api_url=""
+
+  # When a prefix is given, use the matching-refs API for server-side filtering.
+  # This avoids pagination issues with repos that have hundreds of tags (e.g. mongodb/mongo-tools).
+  if [[ -n "$prefix" ]]; then
+    api_url="https://api.github.com/repos/${repo}/git/matching-refs/tags/${prefix}"
+  else
+    api_url="https://api.github.com/repos/${repo}/tags?per_page=100"
+  fi
+
   http_code=$(curl -sSL --max-time 20 -w "%{http_code}" -o /tmp/gh_tags.json \
     -H 'Accept: application/vnd.github+json' \
     -H 'X-GitHub-Api-Version: 2022-11-28' \
     "${header_args[@]}" \
-    "https://api.github.com/repos/${repo}/tags?per_page=100" 2>/dev/null) || true
+    "$api_url" 2>/dev/null) || true
 
   if [[ "$http_code" == "401" ]]; then
     msg_error "GitHub API authentication failed (HTTP 401)."
@@ -2063,12 +2075,19 @@ get_latest_gh_tag() {
   tags_json=$(</tmp/gh_tags.json)
   rm -f /tmp/gh_tags.json
 
-  # Extract tag names, filter by prefix, exclude pre-release patterns, sort by version
+  # Extract tag names depending on API response format
   local latest=""
-  latest=$(echo "$tags_json" | grep -oP '"name":\s*"\K[^"]+' |
-    { [[ -n "$prefix" ]] && grep "^${prefix}" || cat; } |
-    grep -viE '(rc|alpha|beta|dev|test|preview|snapshot)' |
-    sort -V | tail -n1)
+  if [[ -n "$prefix" ]]; then
+    # matching-refs API returns {"ref": "refs/tags/100.14.1", ...}
+    latest=$(echo "$tags_json" | grep -oP '"ref":\s*"refs/tags/\K[^"]+' |
+      grep -viE '(rc|alpha|beta|dev|test|preview|snapshot)' |
+      sort -V | tail -n1)
+  else
+    # tags API returns {"name": "v1.2.3", ...}
+    latest=$(echo "$tags_json" | grep -oP '"name":\s*"\K[^"]+' |
+      grep -viE '(rc|alpha|beta|dev|test|preview|snapshot)' |
+      sort -V | tail -n1)
+  fi
 
   if [[ -z "$latest" ]]; then
     msg_warn "No matching tags found for ${repo}${prefix:+ (prefix: $prefix)}"