Originally, gpg homedir creation happened before scriptworker launched,
and then a background async task polled git and rebuilt the gpg homedirs
if it found a new valid git commit.  In order to sign the gpg keys in
the background, we used async pexpect.

However, as noted in mozilla-releng#21, async pexpect isn't reliable currently.  Our
options included fixing the upstream pexpect bug or pulling the gpg
homedir creation into a separate process that we can call via cron.

This patch allows us to use that latter approach.

Previously, we were creating the gpg lockfile before recreating the
worker gpg homedirs, but after recreating ~/.gnupg to verify the git
repo commits.  This meant we were recreating ~/.gnupg every five
minutes, and could have resulted in a long-running process overrunning
the next, especially if we ever shorten the frequency.

Now we create the lockfile before doing any of it, and clean up after
we're done.  I plan to file a bug about nagios checks for the age of the
lockfile and the various scriptworker logs, so we catch if any of these
take significantly longer than expected.