Otherwise, for some reason user@1000.service can't be stopped while rebooting
after applying an upgrade until the default 2 minutes timeout is reached:

  A stop job is running for User Manager for UID 1000 (x / 2 min)

I suspect that's because the Upgrader is running via sudo as another
user, so the amnesia user's systemd instance is not allowed to kill it
and as a result, the entire session is left in running state.
OTOH this problem does not happen when the persistence setup wizard
or the Unsafe Brower is left running before rebooting; that's perhaps
because they don't run as systemd units.