docs: add venus-specific gotchas from the first production migration (live sysctl, resolv.conf inheritance, STP display red herring)

skills/jail-dedicated-subnet-migration/SKILL.md

@@ -55,6 +55,12 @@ proving it's genuinely invisible outside the host.
    pass out
    EOF
    ```
+   **`sysrc gateway_enable=YES` alone is not enough** — it only persists
+   `net.inet.ip.forwarding=1` for the *next* boot, it doesn't apply it to
+   the live running kernel. Confirmed on venus: NAT looked correctly
+   configured (`pfctl -s nat` showed the rule) but every jail's outbound
+   traffic still timed out until `sysctl net.inet.ip.forwarding=1` was
+   run live. Always run both, not just the `sysrc` persistence step.
    **The `pass in`/`pass out` rules are deliberately permissive** — this
    is a NAT-only ruleset, not a firewall. Don't add restrictive rules
    without separately verifying they don't break existing services
@@ -90,6 +96,24 @@ ping -c2 10.20.0.X                                       # host -> jail, no NAT
 arp-scan --interface=vtnet0 10.20.0.X                    # must show ZERO responses -- proves LAN isolation
 ```
 
+**Bridge port showing `LEARNING` in `ifconfig bastille0` output is a red
+herring, not a real blocker** — host-to-jail `ping` worked fine on venus
+even while the member port's flags still showed `LEARNING` well past the
+RSTP forward-delay window. Don't chase STP state as the cause of a
+connectivity problem without first confirming with a direct `ping` from
+the host that L2 forwarding is actually broken (it usually isn't).
+
+**A fresh jail may inherit a broken `resolv.conf` from the host.** On a
+host running `local_unbound_enable="YES"` (venus does, staging didn't),
+new jails got `nameserver 127.0.0.1` copied into their `resolv.conf` --
+which inside the jail points at the jail's *own* loopback, where nothing
+is listening, not the host's unbound instance. Symptom: raw-IP `fetch`
+still fails with "Transient resolver failure" even after outbound
+NAT/forwarding is confirmed working, because `fetch` calls the resolver
+even for IP literals. Fix: overwrite the jail's `resolv.conf` with public
+DNS directly (`1.1.1.1` / `1.0.0.1`), don't assume the host's own
+`/etc/resolv.conf` is safe to inherit as-is.
+
 ## Migrating an existing jail's content (not just spinning up empty)
 
 Don't destroy-and-rebuild-from-scratch if the jail has real installed