transient-recovery.sh => lockpicker.sh: handle bootloader updates