Local mirror of docker.io/tailscale/tailscale, pinned at v1.94.2 to match
service-versions.yaml and current ringtail proxyclass. Nix-only build via
ringtail's nix-container-builder runner; mirrors upstream Dockerfile
contents (tailscale, tailscaled, containerboot binaries plus iptables,
iproute2, ca-certificates).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
