Qualify grain-ensure exec/unless/onlyif

Change-Id: Ic8b981ebe43eb17fa1a2ed2aef11625ffff35c05