fix(poll): force policy must not downgrade to older tags (fixes #823)

With keel.sh/policy: force (no keel.sh/matchTag), the poll trigger's tag
watcher picked the first tag in the registry tag list that was not the
current tag. Registries return tag lists in creation order (oldest first),
ForcePolicy.Filter did not sort them and ForcePolicy.ShouldUpdate accepted
every tag without any version comparison, so the oldest tag in the
repository won: cp-kafka:7.9.1-1-ubi8 was 'updated' to cp-kafka:3.0.0 and,
more recently, 8.1.0 was 'updated' to 8.0.0.

- ForcePolicy.ShouldUpdate: when both tags parse as semantic versions,
  only update to a strictly newer tag (a re-push of the same tag is still
  an update; non-semver tags keep the previous behavior).
- ForcePolicy.Filter: order candidates newest first, like the other
  policies do - semver tags descending, non-semver tags keeping their
  relative order and trailing the versioned tags.
- Regression tests for the tag watcher and the policy; fix a latent
  panic in testRunHelper when zero events are expected.

Spec-Ref: helix-specs@97ae81a6:000386_investigate