cmd/app: enforce mutable instance exclusion

This avoids invoking undefined behaviour in the underlying overlay filesystem implementation.

Signed-off-by: Ophestra <cat@gensokyo.uk>

cmd/app/main.go

@@ -128,7 +128,12 @@ func main() {
 					config.Container.Home = a
 				}
 
-				return run(ctx, msg, &config)
+				remove, err := acquireTemplate(base, args[0])
+				if err != nil {
+					return err
+				}
+				err = run(ctx, msg, &config)
+				return errors.Join(err, remove())
 			},
 		).Flag(
 			&flagShell,
@@ -180,7 +185,8 @@ func main() {
 					r = io.MultiReader(f, common)
 				}
 
-				config, err = parse(args[0], base, r)
+				var name string
+				config, err = parse(args[0], base, r, &name)
 				if closeErr := f.Close(); err == nil {
 					err = closeErr
 				}
@@ -197,6 +203,9 @@ func main() {
 					config.Container.Args[2] = flagCommand
 				}
 
+				if err = enterTemplate(base, name); err != nil {
+					return err
+				}
 				return run(ctx, msg, config, args[1:]...)
 			},
 		).