fix(master): remember the tag's deployed digest after any tag job (#9)

Renames last_auto_digest to last_tag_digest. FinishJob sets it to the pinned
digest after any successful job whose to_ref had no digest, so a rollback
holds however the update was started.

CLAUDE.md

@@ -81,12 +81,12 @@ DATABASE_URL=postgres://... go test -tags integration ./internal/master/store/
   protocol 3 (`protocol.MinPinnedRefVersion`); `Hub.Route` takes the minimum version.
 - **Picking a tagless version (`repo@digest`) leaves the service following no tag:** it is no
   longer polled and the plain Update button is refused.
-- **The poller starts one auto job per digest** (`services.last_auto_digest`, set only when a
-  job row was created; `ErrJobActive` and `NotUpdatableError` leave it so the next cycle
-  retries). It also skips a digest that `desired_ref` (`ref@digest`) already names, and
-  re-reads the service before `Start`. That is why a rollback of an auto service holds until
-  a new digest appears. The webhook does not set it, so a webhook-started update can be
-  followed by a poll job after a rollback.
+- **`services.last_tag_digest`** is set by the poller when it starts an auto job and by
+  `FinishJob` after any successful plain tag job (not pinned/tagless picks; the digest is the
+  one the agent pinned). The poller starts no job for that digest, nor for one `desired_ref`
+  (`ref@digest`) already names, and re-reads the service before `Start`; so a rollback of an
+  auto service holds until the registry shows a different digest. `ErrJobActive` and
+  `NotUpdatableError` leave it unset so the next cycle retries.
 - **A bare image's running version is recorded with tag `latest`** (like `jobs.FollowedRef`);
   `repo@digest` is recorded with tag `''`. Only `sha256:<64 hex>` digests are recorded.
 - **Image matching is case-sensitive.** The tricky case is `localhost:5000/foo:v1` where