Fixes #613.

Why

versioned_symbols_policy buckets every version tag by splitting on the first underscore:

sym_name, _, _ = symbol.partition("_")
required_vers.setdefault(sym_name, set()).add(symbol)

For zlib-ng's ZLIB_NG_2.0.0 / ZLIB_NG_2.1.0 tags this produces namespace ZLIB, landing them in the same bucket as stock zlib's ZLIB_1.2.0. Policies whose ZLIB allowlist does not contain ZLIB_NG_* (none do — libz-ng.so.2 is not a manylinux system library) then reject the wheel as carrying "too-recent versioned symbols", even though no symbol is actually too recent. This is exactly what #613 reports, and matches @mayeut's diagnosis on that issue:

it's not intended, needs a fix to exclude ZLIB_NG_*.

The same class of bug also bites CXXABI_LDBL_*.* (long-double-specific libstdc++ symbols), which currently get bucketed into CXXABI and collide with CXXABI_*.*.

What

Match the namespace with a regex that requires a trailing numeric version (\d+(?:[._]\d+)*):

_SYMBOL_VERSION_TAG_RE = re.compile(r"^([A-Za-z][A-Za-z0-9_]*?)_(\d+(?:[._]\d+)*)$")

Now ZLIB_NG_2.0.0 resolves to namespace ZLIB_NG instead of ZLIB, and CXXABI_LDBL_1.3 resolves to CXXABI_LDBL instead of CXXABI. Tags whose suffix is not a numeric version (e.g. GLIBC_PRIVATE, or fully bare tokens with no _) fall back to the original first-underscore split so existing behavior is preserved.

Because ZLIB_NG and CXXABI_LDBL don't appear in any policy's symbol_versions map, the existing set(required_vers) & set(policy_sym_vers) intersection in policy_is_satisfied then drops them from the check entirely — the same way any other unmodelled namespace (e.g. OPENSSL, LIBSSL) already is — and the wheel passes.

Test

Added test_policy_does_not_conflate_zlib_ng_with_zlib covering:

• A wheel with only ZLIB_NG_* tags is accepted (was rejected before).
• A wheel mixing ZLIB_1.2.0 and ZLIB_NG_2.0.0 doesn't poison the ZLIB bucket — the ZLIB_1.2.0 check still has to pass on its own.

The new test plus all existing test_policy.py tests pass:

============================= 19 passed in 0.15s ==============================

(The remaining unit-test failures on Windows are pre-existing environmental issues — symlink privilege, Linux-only ctypes for test_libc.py, Unix permission modes in test_tools.py — and are unrelated to this change.)