add locking to bootloader package build so it can safely be triggered manually
don't keep duplicate copies of firmware packages in both working directory and repo
add code to cleanup old images