units: run firstboot before sysusers, so that firstboot can initialize the root password