restructure the Tailscale network choice, with offscale left to be written

Four options, in the order you gave:

  1  set up your own network        (offscale)
  2  use a network you already run  (headscale, offscale)
  3  the easy route                 (tailscale.com)
  ?  what are tailscale, headscale and offscale?

? prints the long answer and then shows the options again, rather than dropping
the reader back at a bare prompt having forgotten what they were choosing
between.

The explanation frames all three as one question — who keeps the list of your
machines and hands out the keys — and says plainly that the coordination server
never carries traffic, since that is the thing people assume it does. Tailscale
and headscale are written. OFFSCALE is a marked placeholder, and so is what
option 1 actually does; both are yours to fill in and the run says so rather than
pretending.

Option 3 is the plain flow: no --login-server at all, and the auth-key prompt
says what that means — leave it blank and Tailscale prints a link that either
creates the account or adds this machine to an existing one. Option 2 keeps the
"no suggested URL" rule, because a coordination server URL is somebody's private
infrastructure.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/tailscale.sh

@@ -55,6 +55,45 @@ tailscale_help() {
   echo "     lock you out of the machine, so there is always a second way in."
 }
 
+# The long answer, printed when somebody types ?. Covers all three names,
+# because the menu offers all three and two of them are not words anyone outside
+# this project would know.
+tailscale_networks_help() {
+  echo "     Tailscale, headscale and offscale are three answers to one question:"
+  echo "     who keeps the list of your machines and hands out the keys they use"
+  echo "     to find each other."
+  echo ""
+  echo "     The network itself is the same in all three cases. Machines talk"
+  echo "     directly to each other over WireGuard, encrypted end to end. What"
+  echo "     differs is only the coordination server — the thing that knows which"
+  echo "     machines are yours. It never carries your traffic."
+  echo ""
+  echo "  TAILSCALE"
+  echo "     The company's own coordination server. Nothing to run, nothing to"
+  echo "     maintain, free for personal use. You sign in with an existing"
+  echo "     identity and your machines appear in their admin console."
+  echo "     The trade is that the list of your machines lives with them."
+  echo ""
+  echo "  HEADSCALE"
+  echo "     An open-source coordination server you run yourself. The same"
+  echo "     Tailscale clients connect to it, so the machines behave identically;"
+  echo "     the difference is that nobody else holds the list. The cost is that"
+  echo "     it is now a service you host, and it needs to be reachable."
+  echo ""
+  echo "  OFFSCALE"
+  # TODO(pastilhas): your words. What offscale is, how it relates to headscale,
+  # and what "set up your own network" actually does for someone choosing 1.
+  echo "     [ to be written ]"
+  echo ""
+  echo "  FOR OFFICER"
+  echo "     Whichever you pick, the tailnet is what Officer treats as its"
+  echo "     perimeter. ALLOW_ANY_ORIGIN defaults on, and that is only"
+  echo "     defensible because the machine is not reachable from the open"
+  echo "     internet in the first place. Installed at this point in the run,"
+  echo "     before anything that can lock you out, so there is always a second"
+  echo "     way in."
+}
+
 tailscale_is_installed() { command -v tailscale &>/dev/null; }
 
 # NeedsLogin, Running, Stopped, NoState… Read before acting, because the original's