- What I did

Fixed a nil pointer dereference (panic) in pkglib.Pkg.Build at build.go:588 that occurs when pushing with --release and the image already exists in the registry but not in the local cache.

This is a regression introduced in 4129cc7 (#4201), which removed the early return for missing local cache images to allow release tags to be pushed even when the digest tag already exists.

- How I did it

• When desc is nil (image not in local cache) and a release is requested, pull the image into local cache before creating the release tag.
• Guard the targetDocker block against nil descriptors — if nothing is in local cache, there is nothing to load into Docker.
• Fixed the FindDescriptor mock in tests to return nil, nil when not found, matching the real implementation's documented behavior.
• Added TestPushReleaseImageInRegistry regression test that reproduces the exact panic.

- How to verify it

Run the new test without the fix to see the panic:

cd src/cmd/linuxkit
git stash push -- pkglib/build.go
go test ./pkglib/ -run TestPushReleaseImageInRegistry -v
# panics with: nil pointer dereference at build.go:588
git stash pop

Run all tests with the fix:

make local
# All tests pass, including the new regression test

- Description for the changelog

Fix nil pointer dereference when pushing with --release and the image already exists in the registry but not in the local cache.