Guard deploys and config changes against leftover state on retry

- Extract deploy.Run's snapshot -> apply -> restart -> health-check ->
  rollback-on-failure sequence into deploy.GuardedApply, shared with
  cmd/skiff's applyConfigChange, which duplicated it verbatim.
- Clean up the worktree and snapshot a deploy creates when it fails
  before cutover (e.g. a failing release-phase migration), so retrying
  the same sha no longer needs manual cleanup.
- Make checkout and snapshotting idempotent for a same-sha retry after
  a cutover that later got rolled back on a failed health check, where
  the release dir and snapshot are deliberately left behind by design.
- Document the actual cause of a jail not surviving a host reboot:
  FreeBSD ships no /etc/jail.conf, so boot-time `service jail start`
  finds nothing to start regardless of jail.conf.d - only name-targeted
  starts read jail.conf.d directly, which is why manual starts worked.

0 files changed, 0 insertions, 0 deletions