tools: add support for Twoliter.override in docker-run

[jpculp]

Description of changes:

make full-config ignored Twoliter.override while make (the normal build path) honored it. This PR makes tools/docker-run.sh resolve the Bottlerocket SDK image through Twoliter when an override is present, so full-config now runs inside the same (possibly overridden) SDK container as a regular build.

Why the two paths behaved differently:

The kernel kit has two ways of launching work in the SDK container:

• make / make build delegates to the Twoliter binary (twoliter build kit ...). Twoliter itself reads Twoliter.toml, layers Twoliter.override on top, and resolves the final SDK image. Overrides are therefore honored automatically.

• make full-config does not go through Twoliter. It runs tools/docker-run.sh, which picked the SDK image itself by grepping Twoliter.lock:

  find_sdk() {
    grep -A5 '^\[sdk\]' Twoliter.lock | grep '^source' | cut -d'"' -f2
  }

The key insight is that Twoliter.override is intentionally never written into Twoliter.lock. The lock file always records the canonical SDK source (e.g. public.ecr.aws/bottlerocket/bottlerocket-sdk:v0.79.0) plus its digest, so it remains a reproducible, shareable record. The override is a local, .gitignored redirect that Twoliter applies at runtime. Because docker-run.sh only read the lock's source line, it could never see the override — so full-config always tried to pull the canonical image and failed when that image wasn't the one the developer intended to use:

Using SDK: public.ecr.aws/bottlerocket/bottlerocket-sdk:v0.79.0 to run the provided script
docker: Error response from daemon: manifest for public.ecr.aws/bottlerocket/bottlerocket-sdk:v0.79.0 not found

Testing done:

Verified find_sdk:

• With Twoliter.override present → resolves to the overridden image (e.g. <account>.dkr.ecr.<region>.amazonaws.com/<name>:v0.79.0).
• Without Twoliter.override → falls back to the canonical public.ecr.aws/bottlerocket/bottlerocket-sdk:v0.79.0 from Twoliter.lock.
• bash -n tools/docker-run.sh passes (syntax check).
• Confirmed the status message is emitted on stderr and is not captured into the SDK value.
• Built the kernel kit using a new SDK from the tip of develop using an override.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.