Production and staging must deploy the same tested binary. Which release process best preserves artifact integrity?

1. Rebuild from the current branch independently in production
2. Change artifact contents after approval without a new validation
3. Deploy whichever file a developer most recently edited locally
4. Build once, publish a versioned artifact, and promote that artifact through environments