lead the Tailscale section with the question, not the explanation

Ten lines of prose before the first prompt assumed the reader had never heard of
Tailscale. Anyone already running it does not need to be told what it is, and
having to scroll past it every run is the cost of writing for the other reader.

The prompt comes first now, and `?` is an answer. Typing it prints the full
description and asks again; not typing it costs nothing.

confirm() takes an optional help function as its third argument. Where one is
given the prompt becomes [Y/n/?], so the explanation announces that it is
available without taking up room. The same hook is there for any other section
that wants it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/tailscale.sh

@@ -33,6 +33,28 @@ MACHINE_SETUP_TAILSCALE_LOADED=1
 TS_EXIT_SYSCTL=/etc/sysctl.d/99-tailscale-exit.conf
 TS_DISPATCHER=/etc/networkd-dispatcher/routable.d/50-tailscale-exit
 
+# Printed only when asked for. The section leads with the question rather than
+# with ten lines of explanation: somebody who runs Tailscale already does not need
+# to be told what it is, and somebody who does not can type ?.
+tailscale_help() {
+  echo "     Tailscale is a private network between your own machines, over"
+  echo "     WireGuard. Every device you enrol gets a stable 100.x address and"
+  echo "     can reach every other, wherever they are — through NAT, across"
+  echo "     providers, without either end having a public address."
+  echo ""
+  echo "     Nothing is published to the open internet to make that work: no"
+  echo "     port forwarding, no exposed ports, no holes in the firewall."
+  echo ""
+  echo "     For Officer it is not a convenience. The platform is built assuming"
+  echo "     the tailnet IS the perimeter — ALLOW_ANY_ORIGIN defaults on, and"
+  echo "     that is only defensible because the machine is not reachable from"
+  echo "     outside in the first place. A valid token plus the tailnet is the"
+  echo "     lock; without the tailnet it is one layer short of its design."
+  echo ""
+  echo "     It is installed at this point in the run, before anything that can"
+  echo "     lock you out of the machine, so there is always a second way in."
+}
+
 tailscale_is_installed() { command -v tailscale &>/dev/null; }
 
 # NeedsLogin, Running, Stopped, NoState… Read before acting, because the original's