fix(maintenance): handle Debian epoch versions

[ardentperf]

Description

Preserve Debian epochs as hyphenated OCI image tag prefixes, matching docker-bake.hcl and the published extension images.

Type of change

• Update to an existing extension (version bump, fix)
• Shared build infrastructure / tooling change
• Documentation only
• Other (please describe above)

I dont think any current extensions have an epoch or they'd have broken. I bumped into this while building https://github.com/cnpg-extensions

---

Contributor checklist

• My commits are signed off for DCO
  compliance (git commit -s).
• This PR targets the main branch of the upstream repository.
• task checks:all passes locally.
• For changes affecting one or more extensions, the relevant build and E2E
  tests pass (e.g. task bake TARGET=<ext>, task e2e:test:full TARGET=<ext>).
• Any // renovate: comments touched in metadata.hcl / README.md remain
  intact (suite=, depName=, extractVersion=).
• Documentation (README.md, BUILD.md, ...) updated where relevant.

---

Maintainer review checklist

• CI is green for all affected targets / shared changes.
• DCO check passes.
• Change reviewed for correctness and scope; no unintended targets rebuilt.
• // renovate: annotations preserved so automated version tracking keeps
  working.
• If shared infrastructure changed, the _shared filter in
  .github/workflows/bake.yml was updated when all extensions must rebuild.
• PR targets main and is ready to merge.