Consider replacing `reboot-guard` with `systemctl mask reboot.target`

It seems like we only use the most basic functionality of reboot-guard which AFAICT is equivalent to systemctl mask reboot.target.