fix(deploy): preserve resolved image digest for Machines

[ruizkinio]

What changed

• Preserve the resolved tag@sha256 reference when constructing Machine deployment arguments and deployment status.
• Assert the immutable reference on every app Machine created by the deploy command.
• Assert the same immutable reference on new and reused release-command Machine configs.

Why

Image resolution already returns both Tag and Digest, but the deploy path passed only img.Tag. A mutable tag could therefore be resolved correctly and then used without its digest by the release command and serving Machines.

Validation

• go test ./... -count=1
• go vet ./internal/build/imgsrc ./internal/command/deploy