A container release must deploy exactly the image tested in CI even if a mutable tag is later reused. Which artifact reference best supports this?

1. Rebuild from an unpinned dependency set separately in production without comparing artifacts.
2. Deploy latest and assume it can never point to different content.
3. Use the tested image digest or appropriately enforced immutable version tag and retain release metadata.
4. Use only the repository display description as the image version.