Why is tagging an image :latest a real risk for anything deployed to production?

`:latest` is just a mutable pointer to whatever manifest was last pushed to that tag — it provides no way to know what code it actually contains, and repointing it while something is already running gives no reliable way to reproduce or roll back to what was actually deployed at a given time.