Avoid marking USR partition good if torcx failed to start

[bgilbert]

Issue Report

Feature Request

Environment

Any

Desired Feature

If torcx is enabled but fails to run, the OS will end up without software (e.g. Docker) that the user has explicitly requested. If this is due to an OS update, we should probably consider the update to have failed, and roll back to the previous version.

This could be implemented using the mechanism proposed in #2292 or, as an interim measure, via a special-case dependency added to update-engine.service.

cc @crawford