Manage the published quick start's pins, and fail closed on every release-tooling edge

README.md

@@ -1416,12 +1416,14 @@ whose `major.minor` disagrees with `HOST_API_VERSION` and naming the value to se
 
 **The Docker Hub overview** is published by a separate `publish-overview` job from
 [`release-tooling/dockerhub-overview.md.tmpl`](release-tooling/dockerhub-overview.md.tmpl), with
-`{{VERSION}}` rendered to the release, so the image tags it tells adopters to pull cannot go stale.
+`{{VERSION}}` rendered to the release, so the Plainpages tag it tells adopters to pull cannot go
+stale. Its sidecar pins are Renovate-managed and gated against this repo's own compose files, so the
+quick start stays a topology CI has actually run.
 It is its own job for two reasons: the images are already pushed and irreversible by then, so a Hub
 outage leaves the promotion green and the images untouched; and the page has its own door — run the
 workflow manually with an `overview_version` input to republish it without cutting a release. That
-input goes through the same contract check as a tag, so a typo cannot publish a pull tag nobody can
-resolve. It uses
+input goes through the same contract check as a tag: a non-semver value, or one whose `major.minor`
+disagrees with the tree being published, is refused. It uses
 `DOCKERHUB_OVERVIEW_TOKEN`, separate from the image-push token because editing repository metadata is
 a different permission and widening the push credential to cover it would widen what a leak costs.