Install and upgrade the persistent Tailcat endpoint #877

Parent

#868

What to build

Installing a Machine starts its Tailcat endpoint through the shared installer and systemd. Restarts and upgrades preserve access without re-enrollment or workload interruption. Reuse the shared installer and bounded upgrade engine delivered by merged #827. The remaining Cloud UI work under #822 is outside this ticket and does not block it.

Acceptance criteria

• Ship the same prebuilt native helper through existing artifact verification and installation; install/start/upgrade/remove its systemd service. No runtime compiler/download of dependencies, mandatory container image pipeline, TUN or additional networking privilege.
• Persist node key and PSK atomically in protected Machine state. Unreadable existing state fails visibly rather than silently generating a new identity; service and daemon-socket recreation reconnect successfully.
• Keep forwarding restricted to the daemon Unix socket and require outbound TLS relay operation with no inbound management listener. Tailcat failures never stop workloads or change kernel WireGuard state.
• Reuse the bounded upgrade attempt from Shared Rust Machine installer and bounded CLI/Cloud upgrades #822 and preserve independent SSH bootstrap/recovery. Verify exact artifact/version compatibility using existing release conventions.
• Rung 1 — helper install/artifact contracts. Rung 4 — actual systemd service, socket recreation, restart/upgrade identity persistence and removal; register any informing test in the existing runner. Release archive authority evidence belongs to the final release qualification ticket.

Blocked by

• Manage a Machine from the CLI over Tailcat #876