feat: PrivateTmp=yes drop-in for systemd-tmpfiles on ZFS-root

On ZFS-on-root, statx() across sibling services'
/var/tmp/systemd-private-*/tmp mounts returns errno 132 (ENOTNAM).
This produces 10-30 journal errors per boot and causes
systemd-tmpfiles-clean.service to fail every periodic run
(exit 73 / CANTCREAT). Running tmpfiles inside its own mount
namespace avoids traversing sibling private-tmp paths.

install_zfs() now calls configure_tmpfiles_private_tmp() between
configure_zfs_tools and sync_efi_partitions, so the genesis snapshot
captures the drop-ins. Btrfs path is untouched — errno 132 is
ZFS-specific.

The drop-in file-writing is factored into install_dropin() in
lib/common.sh (service, name, root; body from stdin). Six bats tests
exercise path, content, directory permissions, idempotent overwrite,
empty content, and special-character preservation.

Full root-cause write-up and verification steps in
docs/zfs-tmpfiles-private-tmp-fix.md.

2 files changed, 34 insertions, 0 deletions

diff --git a/installer/archangel b/installer/archangel
index f103fe9..aa8eeaa 100755
--- a/installer/archangel
+++ b/installer/archangel
@@ -1269,6 +1269,25 @@ configure_zfs_tools() {
     info "Tip: Install sanoid for automated snapshot retention."
 }
 
+configure_tmpfiles_private_tmp() {
+    # On ZFS-on-root, statx() across sibling services' /var/tmp/systemd-private-*/tmp
+    # mounts returns errno 132 (ENOTNAM). Running tmpfiles in its own mount
+    # namespace avoids traversing them. See docs/zfs-tmpfiles-private-tmp-fix.md.
+    step "Isolating systemd-tmpfiles from sibling private-tmp (ZFS)"
+
+    local svc
+    for svc in systemd-tmpfiles-setup systemd-tmpfiles-clean; do
+        install_dropin "$svc" zfs-private-tmp /mnt << 'EOF'
+# ZFS: statx of sibling services' /var/tmp/systemd-private-*/tmp mounts
+# returns errno 132. Running in own namespace avoids traversing them.
+[Service]
+PrivateTmp=yes
+EOF
+    done
+
+    info "systemd-tmpfiles drop-ins installed (PrivateTmp=yes)."
+}
+
 sync_efi_partitions() {
     # Skip if only one disk
     if [[ ${#EFI_PARTS[@]} -le 1 ]]; then
@@ -1496,6 +1515,7 @@ install_zfs() {
     configure_zfs_services
     configure_pacman_hook
     configure_zfs_tools
+    configure_tmpfiles_private_tmp
     sync_efi_partitions
     create_genesis_snapshot
     cleanup
diff --git a/installer/lib/common.sh b/installer/lib/common.sh
index d181e0b..8193b19 100644
--- a/installer/lib/common.sh
+++ b/installer/lib/common.sh
@@ -222,6 +222,20 @@ disk_in_use() {
     return 1
 }
 
+# Install a systemd drop-in for $service under $root, reading its body
+# from stdin. Creates $root/etc/systemd/system/$service.service.d/ at
+# mode 755 (idempotent) and writes $dropin_name.conf there. Intended
+# for post-pacstrap customization — pass "/mnt" as root at install
+# time; tests pass a tempdir.
+install_dropin() {
+    local service="$1"
+    local dropin_name="$2"
+    local root="$3"
+    local dir="${root}/etc/systemd/system/${service}.service.d"
+    install -d -m 755 "$dir"
+    cat > "${dir}/${dropin_name}.conf"
+}
+
 # List available disks (not in use)
 list_available_disks() {
     local disks=()