Build and publish an app image from source with the pack CLI and a trusted Cloud Native Buildpacks builder.

Documented steps

1. Install the pack CLI via Homebrew (`brew install buildpacks/tap/pack`), package managers, script install, or the buildpacksio/pack container image. Docs: https://buildpacks.io/docs/for-platform-operators/how-to/integrate-ci/pack/
2. List recommended builders: `pack builder suggest` — any builder it returns is trusted by default (https://buildpacks.io/docs/for-platform-operators/how-to/integrate-ci/pack/concepts/trusted_builders/).
3. A builder is 'an OCI image containing an ordered combination of buildpacks and a build-time base image, a lifecycle binary, and a reference to a runtime base image' (https://buildpacks.io/docs/for-app-developers/concepts/builder/).
4. Build to the local Docker daemon: `pack build myapp --path ./app --builder <builder>` (`--builder`/-B selects the builder image). Docs: https://buildpacks.io/docs/for-platform-operators/how-to/integrate-ci/pack/cli/pack_build/
5. To use an untrusted (non-suggested) builder, trust it per-invocation with `--trust-builder`, permanently with `pack config trusted-builders add <builder-name>`, or check with `pack config trusted-builders list`.
6. Publish directly to a registry instead of the daemon: `pack build registry.example.com/myapp:tag --builder <builder> --publish` — '--publish: Publish the application image directly to the container registry specified in <image-name>, instead of the daemon. The run image must also reside in the registry.'
7. Authenticate with `docker login` before publishing to an external registry (per https://buildpacks.io/docs/for-app-developers/how-to/build-inputs/use-cache-image/).
8. To point pack at an alternate daemon (Podman, remote Docker), use `--docker-host <addr>` or `--docker-host inherit` (uses the DOCKER_HOST env var).