Part-way through "make sandbox" stories (tests are passing)

All the "XXX" spots indicate remaining work

Added a utility script for cleaning up leftover mounts (e.g. when a test
is broken and leaves them behind)

Switched back to running the tests as root (the script calls mksandbox,
after all). I expect that eventually with enough mocking, that won't be
necessary, but it's not a high priority because of the chroot.