install to-existing-root: don't blow away /boot until later

In `install to-existing-root`, we can delay blowing away `/boot` until very late in the process - specifically until we've pulled the container image for example, which may hit problems.

It'd make us overall more robust to being `ctrl-c`'d in general and we could even have a last minute extra warning + delay there as it's really that process that's the destructive thing.