After previous failures with pushing a bad builder image, we need a formal process to pushing out new builder image versions.

This process should include preliminary testing, and rolling out to a limited subset of builders so that we can detect problems before they are universal.