Instead of a single ref we use one ref per stage (init, build module X,
cleanup, finish). This means we don't have to iterate in the cache
lookup, and it also means we get clean refs for each stage so one
can easily inspect the differences between the stages.
This has two advantages:
1) If building as non-root, then we can't modify xattrs, such as
selinux ones, yet selinux will write then, making a bare repo
not match the checksums (it has unexpected xattrs that selinux made)
2) We check out as MODE_NONE, not MODE_USER, which in combination with
BARE_USER forces the files to be copied out of the cache, rather
than using hardlinks into the cache which could mutate the cache.