Switch to serialized runner for finalization and rollback jobs

This has two advantages:

• It avoids races where two jobs are meddling with the container registry.
• It let's us set the runner up in a way that the mirroring service is available.