Bind mounts set up in run_chroot_finalizer used to be torn down in finish, but finish doesn't run when a phase between the two raises. Move the unmount loop into a dedicated cleanup_bind_mounts function and call it from main()'s finally so it runs on success, failure, and KeyboardInterrupt.