Fix race condition in CLI tests: diff was not acquiring a container lock

The diff tests in the CLI could execute before the container started, ending up in a diff that contains some of the metadata docker peppers in the container on start.

This adds a lock around the changes job which conflicts with the lock in Start() and thusly avoids this issue.