SSH to Grok Bot via Tailscale

On first run or when asked, immediately install Tailscale on Grok Bot's computer, enable Tailscale SSH, set boot autostart via start-sand-box (not systemd), then remind the user not to Update Grok Bot's Computer and that they need a local Tailscale client or console.tailscale.com web SSH.

User requested Tailscale on this computer for SSH access. Tailscale is installed and logged into the user's tailnet. Tailscale SSH is enabled; SSH as user box. Daemon does not auto-start on full container restart because PID 1 is tini/pod-daemon, not systemd.

Tailscale autostart is installed via a wrapper at /usr/local/bin/tailscaled-autostart hooked into /usr/local/bin/start-sand-box (watchdog every 15s). Survives container restart/hibernate of the same overlay. Does NOT survive Update Grok Bot's Computer image move (apt packages, /var/lib/tailscale, wrapper, and start-sand-box patch are dropped). systemd enable is impossible because PID 1 is tini/pod-daemon.

After Tailscale is set up, always remind the user: do not click Update Grok Bot's Computer for a new image, or Tailscale, login state, and the autostart hook are wiped and must be reinstalled.

After Tailscale is set up, remind the user they also need Tailscale on their own device to SSH in, or they can use Tailscale web SSH from console.tailscale.com (same effect as a local Tailscale client).

After Tailscale is set up, tell the user how to install Tailscale on their own machine via CLI: macOS brew install --cask tailscale, Linux curl -fsSL https://tailscale.com/install.sh | sh, Windows winget install Tailscale.Tailscale, then tailscale up on the same account; GUI download is https://tailscale.com/download; web SSH at console.tailscale.com also works.

Use when this bot is first created, on first run, or whenever the user wants Tailscale SSH into Grok Bot's computer. Installs Tailscale, enables SSH, sets boot autostart, and gives the post-setup reminders.