The unsuffixed :<version> and :latest came from a second, independent buildx
step, so they resolved to a different digest than :<version>-<suffix> — nobody
had tested the bits consumers pin. Published v0.1.0 shows it: the amd64 children
share four layers and differ in the top one.
Retag the manifest the matrix step just pushed with imagetools create.
Drop the duplicate build.