cambios cleanup del registry remoto y tags

README.md

@@ -17,9 +17,25 @@ remote Docker daemon. No external registry is required.
 ```
 
 The script reads `artifactId` and `version` from `pom.xml` for the image name
-and tag, builds for `linux/amd64`, and verifies the image is present on the
-remote after pushing. The temporary registry container and SSH tunnel are removed
-when the script finishes. See `./scripts/build-and-push.sh --help` for all flags.
+and version tag, builds for `linux/amd64`, and verifies the image is present on
+the remote after pushing. On the remote (and locally) that push is tagged three
+ways, all pointing at the same image:
+
+- `<name>:<version>` — the version from `pom.xml` or `--tag`
+- `<name>:latest` — moved to this push on every successful deploy
+- `<name>:sha256-<12 hex chars>` — immutable tag taken from the registry digest
+
+The temporary registry container and SSH tunnel are removed when the script
+finishes. See `./scripts/build-and-push.sh --help` for all flags.
+
+To remove leftover temporary registry containers and `localhost:<port>/...` image
+tags on the remote (for example after an interrupted push or manual tests):
+
+```shell script
+./scripts/build-and-push.sh --remote deploy@prod.example.com --cleanup
+```
+
+This does not rebuild or push; it only needs SSH access to the remote host.
 
 It can be invoked from any directory: by default it resolves the project root
 from the script's own location. Override with `--project-dir PATH` or the