launch all oneshot jobs on device's first boot

this fixes the need to `ssu ur` on device, as this is now elegantly
taken care by oneshot rule in ssu-vendor-data-nemo .spec, which will
fire on device, and not while mic is baking image