[Christof Marti (chrmarti)]

Summary

Broaden the existing Compose workaround from exact versions 2.38.2 / 5.6.0 to all stable numeric patch releases in 2.38.x and 5.6.x, including an optional leading v.

Compose 5.6.1 is a Go security patch on the 5.6.0 release line and does not contain docker/compose#14325. The Docker 29 installer now picks up 5.6.1, so the exact guard added in #1332 no longer enables the workaround and the original fs.read failure is blocking #1329.

Only the shared action changes. Other minor versions, prereleases and development versions remain untouched. The existing BUILDX_BAKE_ENTITLEMENTS_FS=0 scope and consent-check warning are unchanged. This intentionally keeps the workaround active throughout those two minor release lines; remove or narrow it when a fixed Compose ships there.

Related to #1320. Follow-up to #1332; intended to unblock the Dependabot update in #1329.

Validation

• npm run compile and npm run precommit passed.
• YAML and Bash syntax validation passed.
• 31 local cases passed, including 5.6.1, multi-digit patches, optional v prefix, neighboring minor/major versions, prerelease/development strings, and version-command failure.
• Docker 29 CI passed: logs confirm Compose 5.6.1 enables the workaround and all 21 tests pass. The push workflow is fully green. The PR workflow passed all dedicated suites but its catch-all matrix job hit install-hook timeouts: dotfiles (240s) initially, then updateUID (120s) on a targeted retry. These failures are outside the changed version guard; no unrelated test changes made.