The production bot tracks a separate image, conjurer-bot-deploy, so it
updates only when a commit message contains [deploy] - the test bot and
librarian keep updating on every build. On a [deploy] commit the already-
built conjurer-bot:<sha> is re-tagged (same bytes, no rebuild) and pushed
as conjurer-bot-deploy:<sha>; the deploy repo's image-updater tracks that.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>