If you're using --in-place=.tmp instead of -i, be sure to clean up the resulting etc/ntp.conf.tmp so that it doesn't end up in the image. Otherwise, just use -i and leave the backup cleanup to sed.

This looks good! I'll merge after this one fix, and check on one procedural detail internally.