Validate OCI tags from all sources in Build (follow up to 3894)

[jhrozek]

I was Johnny-came-late again for #3894 so I'm sending my comments as a follow-up.

Move tag validation after tag computation so both explicit user-provided tags and config-name fallback tags are validated against the OCI distribution spec. Previously only the explicit opts.Tag was checked, leaving the config name path unvalidated.

Also add debug logging for Push Resolve failures to aid diagnostics without leaking internal paths to API clients.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.90%. Comparing base (0d5e727) to head (d519e0a).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3897      +/-   ##
==========================================
+ Coverage   66.85%   66.90%   +0.04%     
==========================================
  Files         444      444              
  Lines       44630    44631       +1     
==========================================
+ Hits        29839    29859      +20     
+ Misses      12461    12442      -19     
  Partials     2330     2330              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.