Twoliter fails if `build` is a symlink

### Problem

If the `build` directory in a Twoliter workspace is a symlink, Twoliter will fail to execute any of its `tools` from within Docker/BuildKit.

```
0.066 /bin/sh: line 1: /host/build/tools/pipesys: No such file or directory
```

This is because the Twoliter workspace is mounted as `/host` in the Docker build context, which is unlikely to also contain the symlink target for `/host/build`. [When twoliter attempts to execute a tool](https://github.com/bottlerocket-os/twoliter/blob/7eeedfa37bc4a16b059a5a215f7ef1714fdd4c64/twoliter/embedded/build.Dockerfile#L503), it will be unable to find it.

---

### Proposed Solution

* Find an alternative mechanism for injecting Twoliter's "tools" into the build context. Buildkit [supports adding additional arbitrary "build contexts"](https://docs.docker.com/reference/cli/docker/buildx/build/#build-context) to a given build. The `host` mount in our Dockerfile only seems to be used as a mechanism for getting Twoliter's `tools` -- perhaps we could explicitly add a context for the tools which follows symlinks.
* An alternative (though leakier) solution could be to detect that `build` is a symlink that would "escape" the docker build context and raise an error.

Start at twoliter/embedded/build.Dockerfile around line 503 and trace how the workspace mount supplies Twoliter's tools during Docker/BuildKit builds. Compare the proposed additional build context with detecting an escaping build symlink. Done means a workspace with a symlinked build directory either executes its tools successfully or reports a clear, intentional error.

Written by the indexing model from the issue text.