fix(controller): don't set original-image annotation when image is no…

…t rewritten

api/core/v1/pod_webhook.go

@@ -126,15 +126,15 @@ func (a *ImageRewriter) handleContainer(pod *corev1.Pod, container *corev1.Conta
 		} // ignore rewriting invalid images
 	}
 
-	pod.Annotations[annotationKey] = image
-
 	if !rewriteImage {
 		return RewrittenImage{
 			Original:            container.Image,
 			NotRewrittenBecause: "pod doesn't allow to rewrite its images",
 		}
 	}
 
+	pod.Annotations[annotationKey] = image
+
 	sanitizedRegistryName := strings.ReplaceAll(sourceRef.Context().RegistryStr(), ":", "-")
 	image = strings.ReplaceAll(image, sourceRef.Context().RegistryStr(), sanitizedRegistryName)