Container exit events can run after prepareMountPoints observes a
running container but before it restores the volume references.
Cleanup then sees zero active mounts, and restore leaves a reference
that is never released.
Hold the container lock across the running-state check and mount-point
preparation so exit cleanup runs wholly before or after reference
restore.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
