PR-build sha- image tags name the merge commit, so in-PR pins can silently go stale

On pull_request events, build-image.yaml tags pushed images with type=sha computed from the merge commit, not the head commit. Two consequences:

1. A pin committed inside the PR (the values.yaml bump that points e2e at the PR build) can never name the build of the commit that contains it — the pin has to be added after the build, pointing at an earlier merge-commit sha.
2. Any subsequent push touching images/** builds a new sha while values.yaml still pins the old one, so e2e goes green against stale image content with no signal anywhere.

https://github.com/nebari-dev/data-science-pack/pull/241 dodged this only by ordering the pin as the last commit. Possible directions: have e2e fail if the pinned sha does not correspond to the current head's build, tag PR builds with the head sha as well, or have a workflow re-sync the pin on each push.

Raised in review of https://github.com/nebari-dev/data-science-pack/pull/241#pullrequestreview-5054401295.

Start with .github/workflows/build-image.yaml and the values.yaml pin used by e2e; trace how pull_request builds derive their image tags and how later changes under images/** affect the pin. Compare the possible approaches in the issue, then verify that a subsequent push cannot leave e2e silently using stale image content.