Check for push permissions before building

If I'm `ko publish`ing to a registry/repository that I don't have push permissions to (typo, misconfigured auth, incorrect active `gcloud` user), `ko` can check that and fail before building, using ggcr's [`CheckPushPermission`](https://pkg.go.dev/github.com/google/go-containerregistry/pkg/v1/remote#CheckPushPermission).

That has a `TODO`(https://github.com/google/go-containerregistry/issues/412) to make it unnecessary, but I think this is actually a case where it's useful, since it can avoid work and save time before `remote.Write`ing.

Start with the `ko publish` flow and the go-containerregistry `CheckPushPermission` entry point. Trace how the destination registry is selected and where `remote.Write` follows the build; done means an unauthorized destination fails before the image is built, while authorized publishing continues normally.

Written by the indexing model from the issue text.