Always allow finish-with-unlock and relock, even as a very first step.

We run finish-with-unlock and relock when something has gone wrong.
So we *always* want to allow those steps.  Before we were allowing
them everywhere but after the initial properties-file creation.

Auditors: chris

Test Plan:
Fingers crossed