Which command produces the immutable reference you should pin in a production manifest?

1. A az acr repository show-tags
2. ✓ B az acr repository show-manifests --query '[].digest' (correct answer)
3. C az acr build --image myapp:latest
4. D az acr login

Shortcut: show-manifests returns the sha256 digest for each manifest. Referencing myapp@sha256:<digest> guarantees the exact image bits, immune to tag reassignment.