rules_img v0.3.19

Runloop-maintained v0.3.19 assets with idempotent immutable-tag reconciliation. A rejected tag push is accepted only when an authenticated registry HEAD resolves to the intended digest.