Really, all `ostree admin finalize-staged` needs is access to `/sysroot` and `/boot`. So let's activate it right after `local-fs.target` so that it gets deactivated later in the shutdown process. This should allow us to conflict with less services still running and possibly writing things to `/etc`. Related: https://bugzilla.redhat.com/show_bug.cgi?id=1672283 Closes: #1840 Approved by: cgwalters