Split per-app dataset into OS/data layers, add skiff rebuild

Each app now gets two ZFS datasets - a disposable OS layer
(zroot/skiff/appbase/<app>) cloned from base, and a persistent data
layer (zroot/skiff/appdata/<app>) holding releases/current/env/
meta.json/data.db. `skiff rebuild --app|--all` discards and reclones
the OS layer to pick up an OS/toolchain/config-template upgrade,
guarded by the same snapshot-and-rollback safety net as deploy and
config changes; the data layer is never touched.

Also fixes stale docs (builds already run via jexec inside the jail,
not on the host; --iface already auto-aliases the jail's IP, so the
manual ifconfig step and its troubleshooting entry are gone) found
while updating the same sections for this feature.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

1 files changed, 12 insertions, 1 deletions

diff --git a/internal/layout/layout.go b/internal/layout/layout.go
index 34edc32..5ac6c26 100644
--- a/internal/layout/layout.go
+++ b/internal/layout/layout.go
@@ -38,8 +38,19 @@ func Default() Config {
 	}
 }
 
+// AppDataset is the OS layer, cloned from BaseDataset and mounted at
+// JailRoot(app) - the jail's own root. Named "appbase" (not "apps") to
+// read clearly alongside AppDataDataset now that the two are siblings.
 func (c Config) AppDataset(app string) string {
-	return fmt.Sprintf("%s/apps/%s", c.ZFSPool, app)
+	return fmt.Sprintf("%s/appbase/%s", c.ZFSPool, app)
+}
+
+// AppDataDataset is the persistent data layer, mounted at AppDir(app):
+// releases/, current, env, meta.json, and the app's own data.db. It is a
+// separate dataset from AppDataset so `skiff rebuild` can destroy and
+// reclone the OS layer without touching it.
+func (c Config) AppDataDataset(app string) string {
+	return fmt.Sprintf("%s/appdata/%s", c.ZFSPool, app)
 }
 
 func (c Config) JailRoot(app string) string {