fix /system mounting so chef works

Thanks to pasties for telling me my last commit broke chef. This should
restore the functionality while remaining safe.  Keep /system in the
chroot, detect if it's ro when chef is run, then remount ONLY for the
chef run.  This is safe as long as chef doesn't fail in a spectacular
way (and possibly even if it does)