fix: remove automatic image tagging, make it optional

Images are now pushed by digest only by default, with optional tagging
via the new --tag flag. This addresses issue #27 by ensuring:

- No automatic :latest tags are applied during build
- Platform-specific images are never tagged for external use
- Only manifest lists can receive tags when explicitly requested
- Default behavior outputs digest-only references for reproducibility

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Makefile

@@ -94,3 +94,16 @@ check-code:
 
 # Run all checks (format, lint, test)
 check: check-fmt lint test
+
+push-ttl:
+	@echo "Pushing to ttl.sh..."
+	KRUST_REPO=ttl.sh/jason cargo run build ./example/hello-krust
+
+push-gar:
+	@echo "Pushing to gar.sh..."
+	KRUST_REPO=us-central1-docker.pkg.dev/jason-chainguard/krust cargo run build ./example/hello-krust
+
+run-built-image:
+	@image=$$(KRUST_REPO=ttl.sh/jason cargo run build ./example/hello-krust) && \
+	echo "Running image: $$image" && \
+	docker run --rm $$image