Support running integration tests against locally built images

[oysand]

Splits the local-image support out of #83 so it can be reviewed and merged on its own.

Running the integration tests against locally built service images was previously impossible: the images are pulled from ghcr.io, so a change spanning armada and one of the services could not be verified until the service change was merged and published — even though the armada side is what proves the service side works.

This adds:

• scripts/build_local_images.sh — builds flotilla, sara, isar and isar-robot from local checkouts, verifies each image, and optionally runs the suite against them. isar-robot is cloned rather than built from the working tree, because its Dockerfile bind-mounts .git, which is a submodule file in the superrepo.
• MIGRATIONS_SOURCE_DIR / SARA_MIGRATIONS_SOURCE_DIR — takes the database schema from the same local checkouts, so application code and schema agree. The directory is mounted read-only and copied into the migrations container, so uncommitted and untracked migrations are included. bin/obj are excluded deliberately: they are host-architecture output and obj/project.assets.json holds absolute host paths, either of which breaks restore inside the container.
• build_image_once() — a cross-process file lock around building images from local Dockerfiles. DockerImage(...).build() is called per test, so under -n auto a dozen workers build the same tag at once and the losers fail with "already exists, but accessing it also failed". The layer cache normally hides this; it appears the moment one of those images is edited.

Defaults are unchanged — with neither *_SOURCE_DIR set, the behaviour is exactly as before.

Verification

• test_simple_mission_is_successful passes unchanged (published images, cloned migrations).
• The same test passes with MIGRATIONS_SOURCE_DIR and SARA_MIGRATIONS_SOURCE_DIR pointed at local checkouts, exercising the new copy path.

Note for reviewers

#83 is stacked on this branch. Because it is a cross-fork PR its base cannot point here, so it will keep showing these three commits until this one merges; rebasing it onto main afterwards drops them automatically.