This avoids the 3-lock deadlock described in
canonical#314. Other goroutines may be
holding the state lock and waiting for the services lock, so it's
problematic to acquire both locks at once. Break that part of the
cycle.

We could do this inside serviceForStart/serviceForStop by manually
calling Unlock() sooner, but that's error-prone, so continue using
defer, but have the caller write the task log (which needs the state
lock) after the services lock is released.

This test consistently FAILs without the fix in this PR, but
consistently PASSes with the fix in this PR. The repro is basically
as per the instructions at
canonical#314 (comment)