Release 2.3.0.0202: version-tagged images, changelog

- Drone: an image-tags step writes .tags (latest, commit SHA, changelog
  version) for the master publish, so each release can be pulled and
  rolled back by version. The master publish step no longer hardcodes tags.
- Version 2.2.0.0201 -> 2.3.0.0202 in xteve.go and changelog-beta.md, with
  a changelog entry covering the improvements branch.
- README / README-DEV describe the version tag.

tasks/todo.md

@@ -47,7 +47,7 @@ Status: all phases done on branch `improvements` (2026-09-26). Open: the `agent.
 - [x] i18n dropped: 254 placeholders inlined, `en.json` deleted, only HTML pages templated (`authenticationErr`)
 - [x] `package.json` + `ts/tsconfig.json` (tsc 5.9.3, ES2020, single outFile `html/js/app.js`, committed, CI-verified); 10 dead JS files deleted; 6 tsc errors fixed incl. a real ASI bug in the search shortcut
 - [x] CI: vet, gofmt check, staticcheck v0.8.1 (config in `staticcheck.conf`), bundle freshness check. `go test -race` still to add once tests exist
-- [ ] Version-tagged images (amd64 only)
+- [x] Version-tagged images: master publishes `latest`, the commit SHA and the changelog version via a `.tags` file (amd64 only)
 - [x] PUID/PGID via su-exec at runtime; static-ffmpeg pinned to 7.1.1; `VOLUME /xteve/config`; `/xteve` removed from `LEGACY_CONFIG_DIRS`; compose files pull from the registry and document SSDP/host networking
 - [x] `/healthz` endpoint; Dockerfile healthcheck uses it
 - [x] `README-DEV.md` and fork-specific `README.md` (about, container usage, env vars, security notes)