Allow for proposed updates to be published in an isolated, staged manner

[mthalman]

As pointed out in #1371 (comment), it's important to be able to validate updates before they become "live" and used by release builds. But this requires that the proposed changes be applied in an isolated Dockerfile and still published to the registry so the resulting image can be referenced by a test build.

This kind of isolation can be done either with multiple branches (e.g. main and staging) or a single branch with distinct tags that separate out the staging Dockerfile from the production one.