A new release must use the exact container image tested in staging. What should its OKE manifest reference?

1. An unverified latest tag fetched at deployment time.
2. The developer's local image cache without publishing an artifact.
3. The verified immutable image digest or an equivalently controlled immutable version.
4. Only the registry's marketing name.