fix(host): run Tailscale through its real path (#703)

Tailscale.app's binary crashes ("The current bundleIdentifier is unknown
to the registry") when invoked through a symlink such as
/usr/local/bin/tailscale. The helper adopts the login shell PATH, which
can resolve to that symlink, so every status check crashed and Ace
reported "The team's services need Tailscale running on this Mac."

Why: apps/host/src/tailnet.ts#function executable | Tailscale.app's binary must be run by its real path, never through a symlink, or it crashes

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 1cbb2262-7e0b-45cd-a29e-d68510600884

Author: agorischek

apps/host/src/tailnet.ts

@@ -1,5 +1,5 @@
 /** The tailnet is the team: it says who a peer is and which machines can host channels. */
-import { existsSync } from "node:fs";
+import { existsSync, realpathSync } from "node:fs";
 import { isIP } from "node:net";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -27,7 +27,8 @@ export type Machine = { name: string; login: string; address: string; dns: strin
 
 function executable(): string | undefined {
 	const path = Bun.which("tailscale", { PATH: process.env.PATH });
-	if (path) return path;
+	// Tailscale.app's binary crashes when run through a symlink such as /usr/local/bin/tailscale.
+	if (path) return realpathSync(path);
 	if (process.platform !== "darwin") return;
 	return ["/Applications", join(homedir(), "Applications")]
 		.map((dir) => join(dir, "Tailscale.app", "Contents", "MacOS", "Tailscale"))