This hoists the publisher creation out of the loop for `ko publish` to
avoid needlessly resolving credentials multiple times.
This pulls the publisher creation outside of resolveFilesToWriter so we
can fail earlier if e.g. KO_DOCKER_REPO is unset, otherwise we start up
the kubectl goroutine and it would asynchronously fail with:
error: no objects passed to apply