Use finalization locking

[jlebon]

This was mentioned in #165 as a desirable feature, but AFAICT there isn't a card tracking it specifically.

Obviously, this isn't hard to do I think with the current OSTree backend. Though the expectation is that we'll want to retain this semantic when we eventually move to a pure composefs-based backend.