fix(controller): build image from source_tag

'sha' is just metadata. it is not used as a tag on the registry. The release ledger
is append-only, which means that the latest image should be used by default, with an
optional source tag for rollbacks.