Build `docker_image_tag(commit_sha, branch, env)` returning the deterministic image tag used in promotion pipelines: 1. Format: `image:<branch>-<short_sha>-<env>` 2. `short_sha` = first 7 chars of `commit_sha` (the git convention). 3. Branch slashes become dashes (`feature/foo` → `feature-foo`) so the tag is registry-safe. 4. If `env == "prod"`, drop the branch segment entirely: `image:<short_sha>-prod` (prod tags are SHA-only — branch info is noise after merge). 5. Empty branch or empty sha → `"image:invalid"` (defensive — never push a half-built tag).