build-docker-task hardcodes the image tag to SemVer2; wrapper repos need an external version

[ptr727]

Problem

build-docker-task.yml tags the image with :latest/:develop + the NBGV SemVer2:

tags: |
  docker.io/ptr727/projecttemplate:${{ inputs.branch == 'main' && 'latest' || 'develop' }}
  docker.io/ptr727/projecttemplate:${{ needs.get-version.outputs.SemVer2 }}

A repo that wraps an upstream release wants the immutable tag to be the upstream version, not the repo's own NBGV version. ptr727/ESPHome-NonRoot publishes :latest + :<esphome-version> (e.g. :2026.6.2), where the ESPHome version comes from a committed state file, and keeps SemVer2 only for the GitHub release tag + LABEL_VERSION. This required hand-editing the tag block and adding a "read the version" step to the leaf task.

It is reasonable that build-docker-task is part of the build layer a downstream owns, so this may be "working as intended." But since multiple Docker downstreams (ESPHome-NonRoot, and NxWitness with its per-image matrix) diverge here, a short note in AGENTS.md - "the image tag is build-layer-owned; drive it from whatever version source fits (SemVer2, an upstream pin, a matrix)" - would save the next wrapper repo from rediscovering it.

---

Surfaced while adopting the template in ptr727/ESPHome-NonRoot (see ptr727/ESPHome-NonRoot#61).

[ptr727]

Documented in AGENTS.md Release Model that the Docker image tag is build-layer-owned and may be driven by any version source (SemVer2, an upstream pin, or a matrix).

Addressed in #167 (merged to develop; not yet promoted to main, pending any further feedback as these changes are applied downstream).