Separate packaging and publishing of container images
We should
- build our images with Kaniko,
- push them to an internal container registry (we have access to a private Harbor registry),
- run e2e/smoke tests on these images, and
- publish them to the official registry with crane or skopeo.
This way, we don't have to release images before we can push them. In the future, this will also make it easier to run e2e/smoke tests on non-master images.