Add hack/common-envs_test.bats (runs under make bats-unit-tests). For a
representative slice of the root build: matrix — including the two recipes
that previously slipped through, capi-providers-cpprovider and core/talos —
it asserts that under OCI_EXPORT_DIR each built image emits exactly one
--output type=oci and no ungated docker:// push, and that capi emits a single
--tag. This would have caught the talos-push and capi-two-tag regressions.
Refs: #3257
Assisted-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>