tar: file changed as we read it

I've noticed occasional build failures with VMware variants because of errors like this:
```
tar: bottlerocket-vmware-k8s-1.31-x86_64-1.34.0-f3d88ccc6.vmdk: file changed as we read it
```

I'm pretty sure this happens if we get a sequence like this:
1. `rpm2img`, `rpm2kmodkit`, `rpm2migrations` all start
2. `rpm2img` creates the VMDK file
3. `rpm2kmodkit` or `rpm2migrations` finishes
4. `rpm2img` starts the OVA creation
5. the [recursive chown](https://github.com/bottlerocket-os/twoliter/blob/1c96cf1d6c7ff1139bae1837a1e6f841e62863ec/twoliter/embedded/build.Dockerfile#L415) of everything in `/output` starts
6. `rpm2img` observes the VMDK change from `root:root` to `builder:builder` - error!

In theory any of these stages could finish first, then disrupt a `tar` operation in progress in one of the other stages when it runs `chown`.

Start with the recursive chown in twoliter/embedded/build.Dockerfile around line 415, then inspect how rpm2img, rpm2kmodkit, and rpm2migrations run during VMware builds. Reproduce the build failure and verify that the tar operation no longer reports the VMDK as changed while output ownership is updated.

Written by the indexing model from the issue text.