2 slot upgrade scheme
This needs changes to the image build to create the 2 slots.
It also needs some code in the image (or in a container in the image) that actually does the upgrade.
Need to carefully think through fallback to the old image if a new image doesn't boot all the way. Watchdog timer if we have one, or automatic recovery after a manual reboot if we don't.