defer root.json inclusion until image build time

Currently we follow a circuitous path to get `root.json` into the image:
* When building any package, the [PUBLISH_REPO](https://github.com/bottlerocket-os/twoliter/blob/b836d71c53a7c3905e43c37ce6c817d76ade16a9/tools/buildsys/src/builder.rs#L120) environment variable is passed through.
* The Dockerfile uses this to [select a root.json to copy into the build context](https://github.com/bottlerocket-os/twoliter/blob/b836d71c53a7c3905e43c37ce6c817d76ade16a9/twoliter/embedded/Dockerfile#L80).
* We also define [%_cross_repo_root_json](https://github.com/bottlerocket-os/twoliter/blob/b836d71c53a7c3905e43c37ce6c817d76ade16a9/twoliter/embedded/Dockerfile#L98) to refer to this path.
* `os.spec` [treats this as a source file](https://github.com/bottlerocket-os/bottlerocket/blob/673df239fc6c54075b787aa603535c3e0115f07c/packages/os/os.spec#L16) and [copies it into `/usr/share/updog`](https://github.com/bottlerocket-os/bottlerocket/blob/673df239fc6c54075b787aa603535c3e0115f07c/packages/os/os.spec#L472).

From the standpoint of OOTBs, we want to keep `updog` independent from any prospective publisher, so `root.json` should be copied into the image at the last moment as part of the variant build process.