Guard deploys and config changes against leftover state on retry

- Extract deploy.Run's snapshot -> apply -> restart -> health-check ->
  rollback-on-failure sequence into deploy.GuardedApply, shared with
  cmd/skiff's applyConfigChange, which duplicated it verbatim.
- Clean up the worktree and snapshot a deploy creates when it fails
  before cutover (e.g. a failing release-phase migration), so retrying
  the same sha no longer needs manual cleanup.
- Make checkout and snapshotting idempotent for a same-sha retry after
  a cutover that later got rolled back on a failed health check, where
  the release dir and snapshot are deliberately left behind by design.
- Document the actual cause of a jail not surviving a host reboot:
  FreeBSD ships no /etc/jail.conf, so boot-time `service jail start`
  finds nothing to start regardless of jail.conf.d - only name-targeted
  starts read jail.conf.d directly, which is why manual starts worked.

1 files changed, 14 insertions, 0 deletions

diff --git a/README.md b/README.md
index 632fbb0..ba51aba 100644
--- a/README.md
+++ b/README.md
@@ -51,6 +51,20 @@ clone` requires the parent dataset to already exist.
 # mkdir -p /skiff/repos
 ```
 
+### Jail config
+
+FreeBSD doesn't ship an `/etc/jail.conf`, and at boot `service jail start`
+(no jail named) only creates jails it finds in that one file - it never
+looks at `jail.conf.d/` on its own. Point it there once:
+
+```
+# echo '.include "/etc/jail.conf.d/*.conf";' > /etc/jail.conf
+```
+
+Without this, `skiff new-app` and manual `service jail start <app>` still
+work fine - both read `jail.conf.d/<app>.conf` directly - so the gap stays
+hidden until the host reboots and no app jail comes back up.
+
 ### Nginx
 
 Add once to `/usr/local/etc/nginx/nginx.conf`, inside the `http` block: