ci: run Docker Hub README sync after tag push, non-fatal

[pyramation]

Summary

• The README-sync step from ci: sync README to Docker Hub description in publish job #14 failed with Forbidden (Docker Hub rejected the token for the description API) and, because it ran before "Create and push Docker Hub manifests", its failure skipped the Docker Hub tag push entirely — main run 29120008400 published to ghcr only.
• Move the description-sync step after the Docker Hub manifest push and mark it continue-on-error: true, so image publishing can never be blocked by a README sync failure.
• Note: fixing the Forbidden itself likely requires the DOCKERHUB_TOKEN to be an access token with Read, Write, Delete scope (or the account password) — read-write scope is not sufficient for the description API.

Link to Devin session: https://app.devin.ai/sessions/f54f736b3cb24848bbb20474018bc261
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring