feat: document the dedicated-subnet jail migration pattern, update staging jail identity

README.md

@@ -55,9 +55,14 @@ than assuming the delegate can fetch it itself.
   the same bootstrap/wiring file; use self-registration instead. Real
   incident from the iWP Cache build (lost updates, twice).
 - `wordpress-plugin-staging-verification` -- use the persistent
-  `staging-1` jail (real-world plugin set left active) for verifying new
+  `staging1` jail (real-world plugin set left active) for verifying new
   plugins, not a disposable clean-room jail; includes the full
   cache-plugin verification checklist and cosmetic-vs-real error gotchas.
+- `jail-dedicated-subnet-migration` -- move jails from shared-IP-on-LAN
+  aliasing to a dedicated private VNET subnet, eliminating ARP collisions
+  with other physical LAN devices. Full bridge/NAT/pf setup, VNET jail
+  creation syntax, and a content-preserving migration procedure (DB grant
+  re-scoping, hairpin-NAT non-issue, cache-HIT-hides-DB-failures gotcha).
 
 ## Provenance