Sync before/after creating .bootc_labeled

[ckyrouac]

Spawned from #1198 (comment)

I think in order to add a bit more crash resilence here it'd be a good idea to do e.g.:

rustix::fs::fsync(root.as_fd());
root.create(LABELED)?;
rustix::fs::fsync(root.as_fd());
or so - that should help ensure that we don't end up in a situation where (on a system crash) the LABELED file exists but the pending writes to do the relabeling didn't land.

(arg, in a quick test this fails because a cap-std Dir is an O_PATH fd and we can't fsync on that, I will look at a little helper for this)