For Copilot Code Review

• Every image change in a contributor PR requires a manifest bump. For breaking changes such as a base OS change, increment the major component and reset minor and patch components (3.4.0 -> 4.0.0, not 3.4.4). For new features, increment minor and reset patch (3.4.0 -> 3.5.0). For security or bug fixes, increment only patch (3.4.0 -> 3.4.1). Copilot should flag a missing or incorrect bump.
• Release preparation applies its own +0.0.1 bump regardless, then transfers the resulting version to the README. Contributors must update README version pins for major/minor changes; patch PRs must not update those pins, leaving them out of sync until release preparation. This restriction applies only to version pins, so unrelated README documentation edits remain valid.
• Adding a variant means updating the architecture entry in manifest.json, listing the variant in variantTags, and setting it as latest unless it is a preview.
• Example: PR #1548 switched src/typescript-node/.devcontainer/Dockerfile to the 4-* JavaScript base, so src/typescript-node/manifest.json moved from 3.0.3 to 4.0.0, added the *-trixie variants to both variants and build.architectures, updated variantTags, and set build.latest to 24-trixie; src/typescript-node/README.md then reflected the new default tags.