daemon: Always remove pending deployment before we do updates

The RT kernel switch logic operates from the *booted* deployment,
not pending.  I had in my head that the MCO always cleaned up
pending, but due to another bug we didn't.

There's no reason to leave this cleanup to a defer; do it
before we do anything else.

(But keep the defer because it's cleaner to *also* cleanup if
 we fail)

pkg/daemon/update.go

@@ -2120,6 +2120,12 @@ func (dn *CoreOSDaemon) applyLayeredOSChanges(mcDiff machineConfigDiff, oldConfi
 		defer os.Remove(extensionsRepo)
 	}
 
+	// Always clean up pending, because the RT kernel switch logic below operates on booted,
+	// not pending.
+	if err := removePendingDeployment(); err != nil {
+		return fmt.Errorf("failed to remove pending deployment: %w", err)
+	}
+
 	defer func() {
 		// Operations performed by rpm-ostree on the booted system are available
 		// as staged deployment. It gets applied only when we reboot the system.