build: image-packages publishes the packages artifact even with PUSH=0 #4656

make image-packages in packages/core/installer/Makefile runs flux push artifact oci://$(REGISTRY)/cozystack-packages:$(IMAGE_TAG) without reading PUSH, so a local build with PUSH=0 still publishes the packages artifact. Every image target and the talos copies honour PUSH (#4551, #4654), and the installer's own helm push already reads it, so this target is the one left. A plain if around the push isn't enough: the next lines read the digest back from images/cozystack-packages.log and stamp it, so the unpushed case needs its own path, either skipping the digest stamp or stamping from a local build. Fix shape: gate the push on PUSH=1, handle the digest step for PUSH=0, and add a dry-run test that PUSH=0 emits no flux push.