docs(v2.0.0): add explicit base-pi-only* Hub-tag purge step

Document that base-pi-only / base-pi-only-vX.Y.Z on joakimp/pi-devbox are
orphaned legacy artifacts (no pi-devbox build input references them) that
the build-variant-pi-only job re-publishes every release. Purge them from
the pi-devbox Hub repo after PR-5 removes the publisher; before that, the
floating tag just reappears. Added to removal steps + verification.

docs/CLEANUP-v2.0.0.md

@@ -129,6 +129,31 @@ deprecation:
   by `Dockerfile.base` + `Dockerfile.variant` produced by PR-1 of
   this work.
 
+### Purge the orphaned `base-pi-only*` Hub tags (manual, post-merge)
+
+Until PR-5, the `build-variant-pi-only` job re-publishes
+`joakimp/pi-devbox:base-pi-only` (floating) and a fresh
+`base-pi-only-vX.Y.Z` on **every** opencode-devbox release. These tags
+are orphaned legacy artifacts: pi-devbox v1.0.0+ builds its own
+debian-based `base-<hash>` and **no pi-devbox build input references
+`base-pi-only`** (verified 2026-06-10 — only historical mentions remain
+in pi-devbox's CHANGELOG/AGENTS/DOCKER_HUB). Nothing consumes them.
+
+Once PR-5 deletes the `build-variant-pi-only` job, the publisher is
+gone — so this is the moment to purge the accumulated tags from the
+**`joakimp/pi-devbox`** Docker Hub repo (NOT opencode-devbox):
+
+- Delete the floating `base-pi-only` tag.
+- Delete every versioned snapshot: `base-pi-only-v1.17.2`,
+  `base-pi-only-v1.16.2`, `base-pi-only-v1.15.13e`, … (all of them).
+
+Do this **after** PR-5 is merged and the first post-PR-5 release has
+built, to confirm no new `base-pi-only*` tag reappears. If you purge
+before PR-5, the next opencode-devbox release simply recreates the
+floating tag (whack-a-mole). Deletion is via the Hub UI
+(`hub.docker.com/r/joakimp/pi-devbox/tags`) or the Hub API
+(`DELETE /v2/repositories/joakimp/pi-devbox/tags/<tag>/` with a Hub PAT).
+
 ## Two-step deprecation path (recommended)
 
 Rather than a single big-bang removal, use a deprecation cycle:
@@ -194,6 +219,7 @@ After PR-5 lands, the following should be true:
 - `grep -ri "INSTALL_PI\|pi-toolkit\|pi-extensions\|pi-fork\|pi-observational-memory\|base-pi-only" .` in opencode-devbox returns no matches.
 - `docker history joakimp/opencode-devbox:latest` shows no pi-related layers.
 - The opencode-devbox CI matrix builds only `base` and `omos` variants.
+- A post-PR-5 release does NOT recreate any `joakimp/pi-devbox:base-pi-only*` tag (publisher confirmed gone), after which those orphaned tags are purged from the pi-devbox Hub repo.
 - pi-devbox CI is unaffected (it's a different repo).
 - Both repos build cleanly in their own CI without referencing the other.