fix(ci): update-description must depend on resolve-versions

Run 376 published the Hub description with PI_VERSION=empty ("Current
:latest ships pi `` ") because the update-description job has
needs: [build-variant] but not resolve-versions. In Gitea Actions
needs.<job>.outputs.* only resolves for jobs in your needs: list.

The post-substitution sanity-check (grep -q '{{PI_VERSION}}') passed
because sed had successfully replaced the placeholder — with empty
string. Pre-empted by adding a non-empty assertion in this commit:
the step now fails loudly if PI_VERSION resolves to empty rather than
silently publishing a broken description.

.gitea/workflows/docker-publish.yml

@@ -398,7 +398,7 @@ jobs:
 
   # ── Phase 6: update Hub description (only on real release runs) ────
   update-description:
-    needs: [build-variant]
+    needs: [build-variant, resolve-versions]
     if: |
       always() &&
       needs.build-variant.result == 'success' &&
@@ -417,6 +417,13 @@ jobs:
           # placeholder lives in DOCKER_HUB.md (committed); CI fills it
           # at publish time using the same resolved version that was
           # baked into the variant image. No drift between page and image.
+          if [ -z "${PI_VERSION}" ]; then
+            echo "::error::PI_VERSION env var is empty. Likely cause: the"
+            echo "::error::update-description job is missing 'resolve-versions'"
+            echo "::error::in its needs: list, so needs.resolve-versions.outputs.pi_version"
+            echo "::error::resolves to an empty string instead of the actual version."
+            exit 1
+          fi
           cp DOCKER_HUB.md /tmp/hub-full.md
           sed -i "s/{{PI_VERSION}}/${PI_VERSION}/g" /tmp/hub-full.md
           if grep -q '{{PI_VERSION}}' /tmp/hub-full.md; then