frame the public server as common to all three, not a cost of offscale

"offscale runs on a publicly reachable server" read as a demand offscale makes
and the easy route does not. It is not. Tailscale's coordination server is
publicly reachable too — they run it for you, and that is the entire difference
between option 3 and hosting it yourself.

Said that way round, the requirement stops being a reason not to self-host and
becomes what self-hosting means. Same sentence in all three places: the menu
entry, the branch taken when 1 is chosen, and the long answer.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/tailscale.sh

@@ -67,10 +67,12 @@ tailscale_network_menu() {
   echo "         neither — it runs headscale's open-source code. What changes is"
   echo "         the work: managed from an app rather than a terminal, and"
   echo "         enrolling a device is a link and a tap."
-  echo "         It runs somewhere publicly reachable — a small VPS — not on this"
-  echo "         machine and not at home. Every device has to be able to find it,"
-  echo "         including the ones that are not on your network, so it needs an"
-  echo "         address that resolves from anywhere."
+  echo "         offscale — just like headscale, and just like Tailscale's own"
+  echo "         service — needs to run on a publicly reachable server of its"
+  echo "         own. A small VPS is enough. Not this machine, not behind a home"
+  echo "         router: every device that joins has to find it, including phones"
+  echo "         on mobile data. The only difference from option 3 is who runs"
+  echo "         that server."
   echo "         Follow that setup through first, then come back here with its"
   echo "         address and a key."
   echo "         https://officer.dev/infrastructure/offscale.html#install"
@@ -136,12 +138,17 @@ tailscale_networks_help() {
   # Where it runs matters more than how it installs, and is the thing people
   # get wrong: a coordination server at home is unreachable from exactly the
   # devices a private network exists to reach.
-  echo "     Where it runs: somewhere publicly reachable, on its own — a small"
+  echo "     Where it runs: on a publicly reachable server of its own — a small"
   echo "     VPS is enough. Not on this machine, and not behind a home router."
   echo "     Every device that joins has to find it, including phones on mobile"
   echo "     data and laptops in other buildings, so it needs an address that"
-  echo "     resolves from anywhere. That is true of headscale too; it is a"
-  echo "     property of being the thing everyone checks in with."
+  echo "     resolves from anywhere."
+  echo ""
+  echo "     This is not something offscale asks for and the others do not. It"
+  echo "     is true of headscale, and it is true of Tailscale — their"
+  echo "     coordination server is publicly reachable too, they simply run it"
+  echo "     for you. That is the whole of the difference between choosing"
+  echo "     option 3 and choosing to host it yourself."
   echo ""
   echo "     What it does that plain headscale does not:"
   echo "       · installs in one command on that server, certificates included"