borgbackup: add constrained updateScript

Add passthru.updateScript using nix-update-script and restrict it to tags
matching x.y.z. This ensures automatic update PRs by r-ryantm only target
upstream release tags and skip pre-releases or other non-release tags.

pkgs/by-name/bo/borgbackup/package.nix

@@ -13,6 +13,7 @@
   zstd,
   installShellFiles,
   nixosTests,
+  nix-update-script,
 }:
 
 let
@@ -143,6 +144,14 @@ python.pkgs.buildPythonApplication rec {
 
   disabled = python.pythonOlder "3.9";
 
+  passthru.updateScript = nix-update-script {
+    # Only match tags formatted as x.y.z (e.g., 1.2.3)
+    extraArgs = [
+      "--version-regex"
+      "^([0-9]+\\.[0-9]+\\.[0-9]+)$"
+    ];
+  };
+
   meta = with lib; {
     changelog = "https://github.com/borgbackup/borg/blob/${src.rev}/docs/changes.rst";
     description = "Deduplicating archiver with compression and encryption";