Move update hook location and clean-up on success

/run is noexec, so we can't actually execute the update hook, so
we move it to /var/tmp instead (Trac: #1461)

We also clean up the hook upon successful execution