Put 'system provisioned' and 'app provisioned' side by side.
Only allow 'app provisioned' to run as app_user.
Provision the app itself last for each rack application, after the db.
Start unicorn as the final step of 'rack app'.
Use (and check for) 'yes'/'no' for the "respawn" upstart option.
Set up unicorn as a an upstart 'task', which means it runs as a once-off, blocking process.