docker: do not publish a floating :latest

A floating tag silently substitutes the image under consumers who did not ask
for a new one — the same hazard already avoided by pinning the pre-commit step.

Alias only :<version> onto the default distro's build.
Drop the :latest references from the README, distro.env and check-distros.

README.md

@@ -2,8 +2,8 @@
 
 The estate's Go toolchain image, built on each `container-base` distro image.
 Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:<version>-<suffix>`;
-the default distro's build is retagged as the unsuffixed `:<version>` and `:latest`,
-so all three resolve to one digest.
+the default distro's build is retagged as the unsuffixed `:<version>`, so both resolve
+to one digest. No `:latest` — nothing in the estate floats.
 
 | distro | from | tag suffix | default |
 | --- | --- | --- | --- |