tagfish updates tags but not SHA256 checksum

[mdub]

I used tagfish update to grab a new image:

$ tagfish update config/app-image.yml 
 app:
-  image: registry.cowbell.realestate.com.au/cbde/tlap:201609211804@sha256:875d56d4fe9c5afbf349cfd53d51e32fbe2489731d3fcefdbb6f4df4701e9f28
+  image: registry.cowbell.realestate.com.au/cbde/tlap:201611171334@sha256:875d56d4fe9c5afbf349cfd53d51e32fbe2489731d3fcefdbb6f4df4701e9f28

Note how it's updated the tag from 201609211804 to 201611171334. But, the @sha256 checksum still references the original image (tagged 201609211804)!

$ docker pull registry.cowbell.realestate.com.au/cbde/tlap:201611171334
201611171334: Pulling from cbde/tlap
Digest: sha256:47da9f737292651d6c31ff11948fb630d35e2c05d7a79156d887a5f902ea5e81

This is misleading and dangerous, as when both TAG and SHA256 are present, Docker will ignore the tag.