zsh mangles $VAR:latest because :l is a history modifier

In zsh, an unbraced $R:latest is parsed as $R plus the :l (lowercase) modifier followed by the literal atest. docker tag/docker push $R:latest therefore targets a repo ending in ...-apiatest and ECR fails with name unknown: The repository with name '<repo>atest' does not exist in the registry. The same applies to other modifiers such as :t, :h, :r, and :u. Always write "${R}:latest" in shell commands that may run under zsh, especially commands you hand to a macOS user.