Only push the kubectl tag for stable/tag branches in dev

This puts it inline with the other shared images we build, and makes it safer for us to use this version in our chart.

Currently we use a checksum tag in the charts rather than the kubectl verison, because the kubectl images was potentially being updated in dev branches. This change should allow us to switch to using the more readable version tag.