I have a proposed fix for this here: https://github.com/ceph/ceph/pull/40577

Unfortunately, this won't help you until it is tested and merged and
included in 16.2.1. If you'd like to finish your upgrade before then,
you can upgrade to the pacific branch tip with

ceph orch upgrade start quay.ceph.io/ceph-ci/ceph:pacific

That will include a handful of patches beyond the initial 16.2.0 (so
far, mostly small cephadm fixes), although be aware that that tag is
rebuilt nightly and will include more as time goes on.

There is probably some workaround to induce docker to consistently
include (or not include) the "docker.io/" prefix on the digest but I'm
not sure what that would be. You can also just leave the cluster as
is (half-upgraded) until 16.2.1 is out.

Thanks for your help debugging this!
sage