[SandObserver]

Summary

• Add scripts/dockerhub-description.js, which rewrites README.md into the text Docker Hub renders: the centered HTML header is replaced with a markdown equivalent, repo-relative link and image targets become blob/raw URLs, bare #anchor links point at the GitHub README, the table of contents is dropped, and fenced code samples name sandobserver/stackyard instead of ghcr.io/sandobserver/stackyard.
• Throw rather than emit when the result exceeds Docker Hub's 25,000 character limit, which the API otherwise truncates silently, or when the README has no ## heading.
• Add two release-workflow steps, gated on the existing Docker Hub registry choice and on is-prerelease.js reporting a stable tag, that generate the description and push it with peter-evans/dockerhub-description@v4.0.2 (SHA-pinned), including the short description.
• Keep prose recommending ghcr.io as the registry the release signature covers; only code samples switch registry.

Testing
All green. Added 7 tests covering link absolutisation, image rendering, HTML removal, registry substitution, section handling, and both failure modes.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.