chore(ci): build oci_push targets before invoking them

[Strum355]

Today, we use gnu parallel to parallelize running bazel run on oci_push targets. Bazel cli holds an exclusive lock on the server while building, but releases the lock once it runs the excutable of a runnable target. By building the oci_push targets (and their closures) as part of bazel build, we can parallelize building instead of only one oci_push closure at a time, and then there should be minimal bazel server lock when we bazel run in parallel.

It's important we get the flags the same for bazel build and bazel run, hence stamp in both cases

Test plan

Awaiting a main dry-run

Changelog