The spike in https://issues.redhat.com/browse/MCO-312 demonstrated a workable design:

Call this machine-config-daemon-firstboot-old-bootimage.service:

• on firstboot, detect if rpm-ostree is too old to natively understand the new bootimage. If so:
• pull and run new bootimage as privileged container with -v /:/host
• have new ostree extract OS update into running system
• reboot
• machine-config-daemon-firstboot.service runs...

If rpm-ostree is new enough, then just exit and let the -firstboot.service run.