fix(imageupgrade): serialise upgrade calls and sync the ESP directory

[Bugs5382]

What and why

Confirmed in code first, as the issue asked: StageImage, RollbackImage and
ActivateImage took no lock anywhere (internal/grpc, internal/init, and
the realESPMounter that mounts the ESP per call). Two upgrade calls at the
same time could both write EFI/BOOT/BOOTX64.NEW.EFI and leave a
half-written boot image, so this PR covers both halves of the issue.

Serialisation. nodeImageUpgrader (the grpc.ImageUpgrader the node
serves) now holds one sync.Mutex, taken with TryLock at the top of
Stage, Rollback and Activate. A call made while another of the three is
already running is refused immediately with a new sentinel,
grpc.ErrUpgradeInProgress, which the three gRPC handlers map to
FailedPrecondition. TryLock rather than Lock: a concurrent caller is
told outright rather than queued or left racing the one in flight.

ESP directory sync. The activating rename (BOOTX64.NEW.EFI ->
BOOTX64.EFI) is a vfat directory-entry update; a file's own fsync
(already done in WriteFile) doesn't make that entry durable. The FS
interface in internal/imageupgrade gains Sync() error; Stage and
Rollback call it immediately after their renames, and the real ESP
implementation (dirFS in internal/init) opens the mounted root and
fsyncs it.

No docs change: nothing here is a new user-facing behavior, only a
correctness fix to an unlocked race and an unsynced rename that were never
documented as safe.

Refs #373

Verification

• Lint clean
• Tests pass
• Build succeeds
• Documentation updated (if behavior or API changed) -- not needed, see above

How this was verified

• go build ./...
• systemd-run --user --scope -q -p MemoryMax=6G -p MemorySwapMax=0 go test ./... (all packages pass)
• systemd-run --user --scope -q -p MemoryMax=6G -p MemorySwapMax=0 go test -race ./internal/init/... ./internal/imageupgrade/... ./internal/grpc/...
• golangci-lint run ./internal/init/... ./internal/imageupgrade/... ./internal/grpc/... (0 issues)
• gofmt -l . (clean)
• New tests written first and watched fail for the right reason (undefined symbols, then wrong
  call order / wrong error), then made to pass:
  • TestStage_SyncsTheESPDirectoryAfterTheRename / TestRollback_SyncsTheESPDirectoryAfterTheRename
    assert the directory Sync call lands immediately after the activating/restoring rename.
  • TestStage_ReturnsAnErrorWhenTheDirectorySyncFails / TestRollback_ReturnsAnErrorWhenTheDirectorySyncFails
  • TestUpgrader_StageSerializesAgainstAConcurrentStage drives two real goroutines through Stage
    with a blocking Mount hook: the first holds the lock mid-call, the second gets
    ErrUpgradeInProgress immediately, then the first completes cleanly once released.
  • TestUpgrader_StageRefusesWhileAnUpgradeIsInProgress / RollbackRefusesWhileAnUpgradeIsInProgress /
    ActivateRefusesWhileAnUpgradeIsInProgress hold the lock directly and assert each of the three
    entry points refuses rather than mounting the ESP.