A/B partition scheme for atomic, rollback-safe OS updates

[kevinelliott]

Background

The system updater (see docs/UPDATES.md) performs in-place updates today:
apt package/kernel upgrades and even in-place major Debian release upgrades
(e.g. Bookworm → Trixie). This is powerful but not atomic:

• A failed major apt full-upgrade can leave the rootfs in a partial/broken state.
• Container image rollback is best-effort because compose pins :latest.
• There is no clean "boot the previous known-good system" path.

Proposal: A/B (dual-root) partitions

• Two root partitions (A / B) plus a shared data partition for
  /etc/airwaves, Docker volumes, and config.
• Updates are written to the inactive slot; the bootloader is then switched
  to it. The previous slot stays intact for instant rollback.
• A health-gate on first boot of the new slot auto-rolls-back (switch
  bootloader entry) if the system/containers don't come up healthy.
• Pin container images by digest so image rollback is exact.

Scope / open questions

• Bootloader integration per platform: GRUB (x86 UEFI) vs extlinux/U-Boot
  (Armbian SBCs) — needs a per-family approach.
• Partition layout + migration path for already-deployed single-root devices.
• Update artifact format: full rootfs image stream into the inactive slot vs
  package-level sync.
• Coordinate with the manifest work (digest pinning, signed manifests).

References

• docs/UPDATES.md — current updater architecture
• docs/ROADMAP.md — roadmap entry this issue tracks