Make release image tags truly immutable

backend/tests/test_rc5_release_deployment.py

@@ -15,15 +15,20 @@ def test_build_identity_does_not_invalidate_dependency_layers() -> None:
     assert build_identity > source_copy
     assert 'org.opencontainers.image.revision="${GEOINTEL_BUILD_SHA}"' in dockerfile
     assert 'org.opencontainers.image.created="${GEOINTEL_BUILD_TIME}"' in dockerfile
+    assert 'io.geointel.ai.enabled="${GEOINTEL_INSTALL_AI}"' in dockerfile
 
 
 def test_release_deploy_preserves_immutable_and_previous_images() -> None:
     script = (ROOT / "deploy" / "unraid" / "deploy-release.sh").read_text(encoding="utf-8")
 
-    assert 'GEOINTEL_RELEASE_IMAGE="${GEOINTEL_IMAGE_REPOSITORY}:${GEOINTEL_BUILD_SHA}"' in script
+    assert 'GEOINTEL_RELEASE_VARIANT="ai"' in script
+    assert 'GEOINTEL_RELEASE_VARIANT="gis"' in script
+    assert 'GEOINTEL_RELEASE_IMAGE="${GEOINTEL_IMAGE_REPOSITORY}:${GEOINTEL_BUILD_SHA}-${GEOINTEL_RELEASE_VARIANT}"' in script
     assert 'GEOINTEL_PREVIOUS_IMAGE="${GEOINTEL_IMAGE_REPOSITORY}:previous"' in script
-    assert 'docker tag "$current_image_id" "${GEOINTEL_IMAGE_REPOSITORY}:${current_revision}"' in script
     assert 'docker tag "$current_image_id" "$GEOINTEL_PREVIOUS_IMAGE"' in script
+    assert 'if docker image inspect "$GEOINTEL_RELEASE_IMAGE"' in script
+    assert "Immutable release tag has conflicting metadata" in script
+    assert "Reusing existing immutable image" in script
     assert "rollback_previous()" in script
     assert "Deployed immutable image" in script