The two build backends disagree on whether [build].image is a template

[wseaton]

The cluster backend expands spec.image (crucible/src/build.rs:146); the github-actions backend uses it raw (crucible/src/build.rs:228). So the same manifest means different things by backend, and on the github path a templated image becomes a literal {{ ... }} in the pushed ref.

More reachable since 3e8c0d9, which made validate_builds accept templates in image. Either expand it on the github path too, or reject templates there.