fix(imageupgrade): serialise stage, rollback and activate, and sync the ESP directory after the rename #373

What happened

StageImage, RollbackImage and ActivateImage in cryptos-node appear to take no lock, so two upgrade calls at the same time would share BOOTX64.NEW.EFI and could leave a half-written boot image. The ESP directory is also not synced after the rename that swaps the image in, and a vfat rename isn't safe across a power loss without that sync. (Found while designing the rc.1 release gate; confirm in code first.)

Expected behavior

The three calls are serialised: a call made while another is running gets FailedPrecondition. After the rename, the ESP directory is synced so a power loss leaves either the old or the new image, never neither. Tests cover both, written first.

Environment

cryptos-node main (internal/imageupgrade or wherever the image calls live). Part of the v0.1.0-rc.1 release design (decided 2026-10-14).