Environments

The images workloads run on — register a digest-pinned image, or build a content-addressed one from an install spec.