2.0.2 - container-image rule + release tooling fixes

container-image template: when from_artifacts is enabled, the rule
now only fires on tag pipelines. Prior versions fired on main +
Containerfile-changed too, which has no upstream dist/ to COPY
from. Bairn v0.5.0 worked around it with a consumer-side rules
override; future consumers do not need the override.

release-cli step in the catalog meta-pipeline now reads the tag
annotation from a file (release-description.md) instead of a shell-
substituted variable. This avoids the release-cli image evaluating
shell-active text in tag annotations (the 2.0.1 release job died
when the annotation contained component-context syntax).

No template inputs change. Consumers on 2.0.1 can bump straight
to 2.0.2 with no other edits and (if they used the bairn-style
override) drop their build-image rules override.