lead the Tailscale section with the question, not the explanation

Ten lines of prose before the first prompt assumed the reader had never heard of
Tailscale. Anyone already running it does not need to be told what it is, and
having to scroll past it every run is the cost of writing for the other reader.

The prompt comes first now, and `?` is an answer. Typing it prints the full
description and asks again; not typing it costs nothing.

confirm() takes an optional help function as its third argument. Where one is
given the prompt becomes [Y/n/?], so the explanation announces that it is
available without taking up room. The same hook is there for any other section
that wants it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/base.sh

@@ -212,11 +212,17 @@ confirm() {
   # Second argument flips the default. Most questions here are "do the thing you
   # already asked for" and Enter should mean yes; a few are genuine extras, where
   # defaulting to yes would have people agreeing to them by reflex.
-  local default="${2:-y}" answer prompt
+  local default="${2:-y}"
+  # Third is the name of a function that explains the question. Where one is
+  # given, `?` becomes an answer — so the explanation is available to whoever
+  # wants it without being in the way of whoever does not.
+  local help_fn="${3:-}"
+  local answer prompt
 
   [[ "${ASSUME_YES:-}" == "1" ]] && { [[ "$default" == "y" ]] && return 0 || return 1; }
 
   if [[ "$default" == "y" ]]; then prompt="[Y/n]"; else prompt="[y/N]"; fi
+  [[ -n "$help_fn" ]] && prompt="${prompt%]}/?]"
 
   while true; do
     # EOF is not a yes. Without this an unattended run without ASSUME_YES would
@@ -229,7 +235,16 @@ confirm() {
     case "$answer" in
       y | Y | yes | Yes) return 0 ;;
       n | N | no | No) return 1 ;;
-      *) warn "Answer y or n." ;;
+      "?")
+        if [[ -n "$help_fn" ]]; then
+          echo ""
+          "$help_fn"
+          echo ""
+        else
+          warn "Answer y or n."
+        fi
+        ;;
+      *) warn "Answer y or n${help_fn:+, or ? for what this is}." ;;
     esac
   done
 }