Simplify rollback of repo updates

When performing a Bottlerocket release, pubsys provides convenient tools for many steps, like creating repos, and creating and copying AMIs and SSM parameters. AMIs and SSM parameters are easy to roll back if there's an issue, via `promote-ssm` from a previous release, and `publish-ami` with `--revoke`.

However, rolling back a repo is more complicated. You probably don't want to blindly copy a set of repo metadata from a previous release because the expiration time could be approaching or passed - it's unlikely that you would re-sign old sets of metadata, and a rollback may not be initiated for some period after a release.

One option would be to re-sign metadata from the prior release. Another option would be to start with metadata from the latest release, remove the "bad" release from the metadata, and sign that - it's an extra step, but removes the need to know about the prior metadata files.

It would be useful to have such an ability in pubsys directly, without having to use the lower-level updata and tuftool, and to have a Makefile.toml wrapper for it.

Start by reading the existing pubsys workflows for repository updates and the lower-level updata and tuftool operations mentioned in the issue. Compare the rollback approaches described, then identify how a direct pubsys operation and a Makefile.toml wrapper would fit; done means repo rollback no longer requires those lower-level tools.

Written by the indexing model from the issue text.