This is an issue which we're aware of, and I believe it's addressed in ePO 5. Essentially what's happening is this:
ePO only allows one version of the agent to be checked into a particular branch of the repository. A deployment task that is set to install the agent is in effect configured to install whichever agent version isin that branch, as opposed to a specific version: however - and here's where the confusion can arise - when the task is configured, it shows you the version of the agent that is in the branch at that time.
This means in turn that if you check a newer version of the agent into a branch, then any deployment tasks configured to use that branch will see that there is a new version of the agent and upgrade it.