`app_prod.apply` is just an executable target that can do the non-hermetic stuff. The hermetic building of rendered yaml files, docker images containing built a

`app_prod.apply` is just an executable target that can do the non-hermetic stuff. The hermetic building of rendered yaml files, docker images containing built app artifacts, etc. happens through normal Bazel actions.