A deployment audit requires identifying the exact immutable image artifact that was approved. Which image reference is most appropriate?

1. A trusted registry reference pinned to the approved sha256 digest
2. Any repository with a tag named approved
3. The same repository with tag latest
4. An image name stored only in a Pod annotation