GitHub Codespaces devcontainer.json image pinning across create and rebuild

Goal

Keep the Codespaces container image identical between initial creation and subsequent rebuilds when devcontainer.json specifies an image by tag rather than digest.

Constraint

Registry tags are mutable and may be retagged to different image contents. Codespaces does not enforce digest pinning, and lifecycle hooks such as postCreateCommand can run at different points during creation versus rebuild. Organization policies may also restrict base image selection. It is unclear whether a tagged image reference resolves to the same digest on rebuild as it did during creation, or whether a newer tag is pulled when repository files are unchanged.

What determines the resolved image digest during a Codespaces rebuild? Does rebuild reuse the originally created image digest or re-resolve the tag? How can a repository require digest pinning without relying on client-side enforcement?