ci: record pi-studio version as image label

Adds se.jordbo.pi-devbox.pi-studio-version (e.g. v0.9.36) alongside the
existing SHA label, so 'docker inspect' shows the human-readable version.

Plumbing: resolve-versions exposes studio_tag output -> both studio build
steps pass --build-arg PI_STUDIO_VERSION -> Dockerfile.variant declares
ARG PI_STUDIO_VERSION=none and emits the LABEL. Studio-variant only.

Validated: yq parse OK, resolve run-script bash -n OK. No tag.

CHANGELOG.md

@@ -45,8 +45,10 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
   excluded by a strict filter), and pins that tag's commit SHA into
   `PI_STUDIO_REF`. Pinning the SHA (not the moving tag) preserves cache-busting
   and reproducibility, is what `require_sha` demands, and is recorded in the
-  `se.jordbo.pi-devbox.pi-studio-ref` image label. Studio-variant only — not
-  base-affecting; takes effect on the next `-studio` build. No change to the
+  `se.jordbo.pi-devbox.pi-studio-ref` image label. The human-readable tag (e.g.
+  `v0.9.36`) is now also recorded in a new `se.jordbo.pi-devbox.pi-studio-version`
+  label for at-a-glance identification (`docker inspect`). Studio-variant only —
+  not base-affecting; takes effect on the next `-studio` build. No change to the
   resolved commit today (`v0.9.36` == current `main` HEAD).
 
 ### Fixed