On-premises releases publish the checked release image

On-premises release candidates are now built, checked, scanned, and then promoted to the public image tag without being rebuilt. This makes the customer-pulled image match the exact release artifact that passed validation, while deployment scripts also handle server-side apply conflict resolution more safely. See [[feature:onprem-lite-deployment|On-premises and Lite deployment]].