What's the difference between pulling an image by tag versus by digest?

A tag is a mutable pointer that can be repointed to a different manifest by a later push; a digest (content hash) always refers to one exact, immutable set of bytes — pulling by digest guarantees you get the identical image every time, while pulling by tag depends on whatever that tag currently points to.