Sync before/after creating .bootc_labeled

[ckyrouac]

Spawned from https://github.com/bootc-dev/bootc/pull/1198#discussion_r1999645377

I think in order to add a bit more crash resilence here it'd be a good idea to do e.g.:

rustix::fs::fsync(root.as_fd()); root.create(LABELED)?; rustix::fs::fsync(root.as_fd()); or so - that should help ensure that we don't end up in a situation where (on a system crash) the LABELED file exists but the pending writes to do the relabeling didn't land.

(arg, in a quick test this fails because a cap-std Dir is an O_PATH fd and we can't fsync on that, I will look at a little helper for this)