A production container release must reproduce the tested artifact even if a tag later moves. Which TWO practices fit? Select TWO.

1. Treat the registry name alone as a version identifier
2. Resolve an unrestricted latest tag again during production deployment
3. Record the tested image digest in the release record
4. Deploy using that digest through the supported image-reference format