[bobcallaway]

Summary

Avoid unnecessary Bazel analysis-cache invalidation by applying --test_env=DOCKER_HOST consistently across build, test, and cquery commands. This still passes DOCKER_HOST only to test actions.

Batch-build all selected image targets and resolve their output paths with one cquery before starting parallel comparisons. This removes per-image Bazel calls and server contention while letting Bazel rebuild stale outputs. Workers reject missing or ambiguous outputs before pushing images.

Use Bash 3.2-compatible target collection and avoid empty-array expansion under set -u.

Validation

• Single- and multi-target reports matched HEAD byte-for-byte.
• Modifying static/nsswitch.conf changed the pushed image digest without a manual build.
• Reverting the input restored the exact baseline digest without a manual build.
• The empty-selection path exited successfully under Bash 3.2 with set -u.

Scenario	HEAD	This PR	Elapsed-time reduction
Single target, 2 repository entries	24.64s	16.15s	34.5%
Four targets, 8 repository entries	77.84s	67.11s	13.8%

Observed analysis-cache discards decreased from 5 to 0 for the single-target run and from 16 to 0 for the multi-target run. Timings reflect these local benchmark runs.