An auditor asks 'which exact commit is running in production right now' and nobody can answer confidently

The deployment process pulls and runs an image tagged myapp:latest. Propose a remediation that addresses both the immediate question and the systemic gap. Expected reasoning: immediately, check the registry's image history/digest for what 'latest' currently points to and cross-reference push timestamps against commit history to reconstruct the answer. Systemically, switch the pipeline to tag and deploy by immutable identifier (git SHA or build number), updating deployment manifests/scripts to reference that specific tag/digest rather than a floating tag, so this question always has an immediat