Use (and enforce) tag+digest for Cloud Run images

[msuozzo]

Naming images as host/image:tag@sha256:digest would be nice but would be even better if that association were checked/enforced. We do enable immutable tags so it's less risky to enforce on an ongoing basis and the inclusion of the tag would remain helpful as a means of self-documentation.

Cloud Run does not appear to enforce that tags and digests agree at pull time so this may be an unavoidable limitation.