When OCI_EXPORT_DIR is set, every image builds to a per-image OCI archive
(<dir>/<name>.oci.tar) instead of being pushed, and PUSH/LOAD are forced
off. This lets a credential-less build (a fork PR's pull_request run)
produce the images as artifacts that a privileged workflow later pushes
to the registry by digest. The image digest is captured via
--metadata-file regardless of output type, so the values.yaml/.tag refs
baked during the build match exactly what the privileged run pushes.
The output flag is threaded through the image-tags macro, which every
package's buildx call already uses, so no per-package Makefile change is
needed.
Refs: #3257
Assisted-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
