Interrupted docker build silently ships your old image

If a docker build gets killed (timeout, ctrl-c) the tag keeps pointing at the previous image, and a subsequent push succeeds with all-layers-already-exist and the SAME digest - deploys then roll out stale code with no error anywhere. Guard: compare the pushed digest to the previous one, or grep inside the image for a string from the new code (docker run --rm --entrypoint grep img -c NewSymbol /path) before deploying.