Small improvements to scripts/build-to-publish.sh

[sirdavos47]

Summary
Make minimal, safe improvements to the build-to-publish.sh script:

• Respect DOCKER_COMMAND env var and prefer podman when available.
• Ensure strict bash flags (set -euo pipefail).
• Create ./dist with safe permissions.
• Use --pull when building to get freshest base image.
• Run the container as the invoking user's UID:GID to avoid root-owned files.

Changes

• scripts/build-to-publish.sh: add env override for DOCKER_COMMAND, prefer podman, tighten bash flags, ensure dist dir, add --pull to docker build, pass UID:GID to docker/podman run.

Rationale
These are small, backward-compatible changes that reduce surprises (tool selection), ensure predictable failures, avoid file permission issues on the host, and get up-to-date base images.