mzbuild: Don't ignore return code of docker push

[def-]

Proof that this works:

import subprocess
push = subprocess.Popen("ls asd | cat", shell=True)
print(push.wait()) # 0
push = subprocess.Popen("ls asd", shell=True)
print(push.wait()) # 2
push = subprocess.Popen(["/bin/bash", "-c", "set -o pipefail; ls asd | cat"])
print(push.wait()) # 2

Context: https://materializeinc.slack.com/archives/CM7ATT65S/p1736789270342329

Crazy that we never noticed this before! Dockerhub must be pretty reliable. I could not find another usage of us using this pattern in our code.

I'll remove the last commit before submitting.

Checklist

• This PR has adequate test coverage / QA involvement has been duly considered. (trigger-ci for additional test/nightly runs)
• This PR has an associated up-to-date design doc, is a design doc (template), or is sufficiently small to not require a design.
• If this PR evolves an existing $T ⇔ Proto$T mapping (possibly in a backwards-incompatible way), then it is tagged with a T-proto label.
• If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label (example).
• If this PR includes major user-facing behavior changes, I have pinged the relevant PM to schedule a changelog post.

[benesch]

LGTM!