Avoid pinning docker image hash in bazel-testing org (#2784)

In the `bazel-testing` Buildkite org, newly built test images are pushed
to `gcr.io/bazel-public/testing/` without updating the pinned production
hashes in `IMAGE_HASHES`.

This change ensures that jobs running in `bazel-testing` resolve Docker
image tags dynamically from the testing registry prefix rather than
requiring a pinned SHA256 digest.