The release images bake a cargo cache fetched from the lockfile, so a dependency change leaves the pinned images unable to resolve it. The failure surfaces inside a container as an offline checkout error rather than as a stale-image mismatch, so record the regenerated digests alongside the bump that required them.