install to-existing-root: don't blow away /boot until later

In `install to-existing-root`, we can delay blowing away `/boot` until very late in the process - specifically until we've pulled the container image for example, which may hit problems.

It'd make us overall more robust to being `ctrl-c`'d in general and we could even have a last minute extra warning + delay there as it's really that process that's the destructive thing.

Trace the `install to-existing-root` flow and identify where the container image is pulled and where `/boot` is removed. Make the destructive step occur only after the image pull succeeds, and verify that interruption before then does not remove `/boot`; consider the proposed final warning and delay.

Scritto dal modello di indicizzazione a partire dal testo della issue.