What does immutable tagging by git SHA buy you in a CI/CD pipeline?

Every build produces a uniquely and permanently identifiable image tag tied to an exact commit, eliminating the ambiguity of mutable tags like `latest` — you can always trace a running image back to the exact source code that produced it, and rollback means simply redeploying a previous known-good SHA tag.