fix(controller): build image from source_tag

'sha' is just metadata. it is not used as a tag on the registry.

The release ledger is append-only, which means that the latest image should be
used by default, with an optional source tag for rollbacks.