Mutable KDE Neon Docker tag breaks reproducible development image

A repeatable KDE Neon development pipeline pulls the Docker edition image by tag to provision containers with current KDE Plasma, Frameworks, and Applications on an Ubuntu LTS base.

The build is not reproducible if the registry retags or overwrites the same tag after the initial pull, because later containers can install different package versions. KDE Neon overlays KDE repositories on Ubuntu LTS, so dependency drift can occur without explicit pinning, and adding unrelated PPAs or third-party sources raises the risk of shared-library conflicts.

Which image identifier should a CI pipeline pin to guarantee the same KDE Neon user space across rebuilds? Is there a supported digest or snapshot mechanism for long-term retention of a specific KDE Neon Docker edition image?