fix(worker-image): resolve the nodetool-huggingface version after the PyPI wait

[georgi]

The race

docker.yml resolves HF_VERSION in the meta step — the first step of the job — as "latest nodetool-huggingface on PyPI". The "Wait for nodetool-core on PyPI" step runs after it.

Both repos publish on a tag push. Releasing them together (nodetool-core v0.7.10 and nodetool-huggingface v0.7.8, pushed minutes apart today) starts two wheel builds in parallel, and the image job reads "latest" before either has finished. The result is an image tagged :0.7.10 / :latest that bundles the previous nodetool-huggingface.

That is not hypothetical for this release: v0.7.8 carries the nunchaku Qwen rope shim and the FLUX variant routing fix, and an image built from 0.7.7 has neither.

Worse, it was invisible — the version only appeared in a build log line, nothing in the image recorded it.

The fix

• Move the lookup into its own step, placed after the core-on-PyPI wait. That wait already polls for up to 30 minutes and normally costs a minute or more, by which time the sibling repo's wheel has landed.
• Record both versions as OCI labels:

ai.nodetool.core-version
ai.nodetool.huggingface-version

so a pulled image can be checked with docker inspect instead of a rebuild.

workflow_dispatch with an explicit hf_version is unchanged and still wins.

Found while releasing core 0.7.10 and huggingface 0.7.8 together.

[georgi]

Both failure modes are now observed, not predicted. The v0.7.10 tag build (run 32742412809) failed, and its log shows them together:

RUN uv pip install "nodetool-core==0.7.10" "nodetool-huggingface==0.7.7"
  × No solution found when resolving dependencies:
  ╰─▶ Because there is no version of nodetool-core==0.7.10 …

1. nodetool-huggingface==0.7.7 — the race this PR opened for. nodetool-huggingface 0.7.8 was published 12 minutes later, so the image would have shipped without the nunchaku Qwen rope shim (#58) or the FLUX variant routing fix (#59).

2. nodetool-core==0.7.10 not found — a second race, now also fixed here. "Wait for nodetool-core on PyPI" passed, then the install failed on the same version. The wait polled pypi.org/pypi/<pkg>/<version>/json; uv installs from pypi.org/simple. Those are separate surfaces with independent propagation — /pypi/nodetool-core/0.7.10/json answered 200 while /simple/nodetool-core/ still did not list the wheel.

So the wait now polls the simple index, and the resolved nodetool-huggingface version is confirmed there too.

Checked against the live index, including that the check can fail and that the trailing dash anchors the version:

core 0.7.10 -> FOUND     hf 0.7.8 -> FOUND
core 0.7.9  -> FOUND     hf 0.7.7 -> FOUND
core 9.9.9  -> not listed   hf 9.9.9 -> not listed

$ echo 'nodetool_core-0.7.10-py3-none-any.whl' | grep -c "nodetool_core-0.7.1-"
0

Net effect: the 0.7.10 release produced no worker image at all. I have re-dispatched the build manually with version=0.7.10 hf_version=0.7.8.