One-time install steps for the dedicated Tailscale-operator broker account and
socket group, the read-only `--doctor` preflight, upgrade/recovery/quarantine
behavior, and uninstall/rollback/opt-out that removes only broker-owned
listeners and never resets Serve or touches the primary :443 route. Covers plan
layer 5 docs and the host steps handed to the downstream QA canary (PAP-17052).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
