Repos marked build_only: true are backed up before handle_repos()
overwrites them and restored at the end of each image build, so CI
mirror URLs are not baked into the final image.

The cleanup RUN was injected into every Dockerfile, not just images
that called handle_repos() for those repos. Child images with no
backup fell through to "rm -f", deleting the inherited repo file
(e.g. debian.sources in bifrost-base, breaking cpio install).

Fix by adding a {repo}.enabled sentinel that handle_repos creates
when it processes a build_only repo, making the cleanup conditional
on that sentinel.

Change-Id: Ie5b9970a4575b6258dc238059d3f33ddfe155789
Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>