Re-order prune

System resources must be freed after the fence is dismantled because
freeing system resources runs destroy.sh which deletes the directory
containing the persistent fence.

Also rework the recovery test. The only case in which a container
is still pingable after recovery is where garden was previously shut
down gracefully.

Also when cleaning up garden in the test runner, shut down garden
gracefully to avoid test flakiness when the temporary directory ends
up in an unusable state.

With these changes, all the tests run (under fly).