Pins deployment to specific commit SHA tag rather than relying on :latest tag with rollout restart, which fails when the deployment image was previously set to a different tag.