lead the Tailscale section with the question, not the explanation

Ten lines of prose before the first prompt assumed the reader had never heard of
Tailscale. Anyone already running it does not need to be told what it is, and
having to scroll past it every run is the cost of writing for the other reader.

The prompt comes first now, and `?` is an answer. Typing it prints the full
description and asks again; not typing it costs nothing.

confirm() takes an optional help function as its third argument. Where one is
given the prompt becomes [Y/n/?], so the explanation announces that it is
available without taking up room. The same hook is there for any other section
that wants it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/machine-setup.sh

@@ -406,21 +406,12 @@ fi
 step "Tailscale"
 if ! skip; then
   echo ""
-  info "Tailscale — a private network between your machines, over WireGuard"
-  echo "     Every device you enrol gets a stable 100.x address and can reach"
-  echo "     every other, wherever they are. Nothing is published to the open"
-  echo "     internet: no port forwarding, no exposed ports, no firewall holes."
-  echo ""
-  echo "     For Officer this is not a convenience. The platform is built assuming"
-  echo "     the tailnet IS the perimeter — ALLOW_ANY_ORIGIN defaults on, and that"
-  echo "     is only defensible because the machine is not reachable from outside"
-  echo "     in the first place. Installed here, before anything that can lock you"
-  echo "     out, so there is always a second way in."
+  info "Tailscale — a private network between your machines"
 
   if ! tailscale_is_installed; then
+    echo "     not installed on this machine"
     echo ""
-    echo "     not installed"
-    if confirm "Install Tailscale?"; then
+    if confirm "Install Tailscale?" y tailscale_help; then
       tailscale_install
       tailscale_is_installed && ok "$(tailscale version 2>/dev/null | head -1) installed"
     else
@@ -443,7 +434,7 @@ if ! skip; then
       echo ""
       echo "     Already connected. Reconnecting is only needed to change the"
       echo "     control plane or what this node advertises."
-      confirm "Reconfigure it?" n || TS_CONNECT=false
+      confirm "Reconfigure it?" n tailscale_help || TS_CONNECT=false
     fi
 
     if [[ "$TS_CONNECT" == false ]]; then