An administrator needs to inspect a container image before deploying it, verifying the exact build referenced regardless of any moving tag. Which capability, listed under managing OpenShift Container Platform, most directly supports pinning to a specific immutable build?