The retag workflow derived the major version by string-splitting the tag
input, so a 'latest' input would have produced Mlatest-<cluster>. Resolve
the concrete version from the image itself instead: the build stamps
LABEL bricks_version from the BRICKS_VERSION build-arg, so
`crane config | jq .config.Labels.bricks_version` is authoritative and
independent of mutable tag names.

With that in place, default the tag input to 'latest' — the common case
after a promotion — and retag from the resolved version tag rather than
from latest, so the run is traceable and cannot tear if latest moves
mid-run. When resolving, assert latest and the version tag share a digest;
an explicit tag input (rollback) is exempt, since it is expected to differ.

Major is now computed per image inside the loop, and the summary reports
the requested tag, the resolved version(s), and the clusters actually
retagged instead of recomputing a major that no longer exists.