Add fleet Tailscale status command

[peters]

Purpose

Add a read-only fleet status command that probes Surge-managed nodes over Tailscale SSH and summarizes whether each node is on the expected app, channel, and version.

Behavior

• Adds surge fleet-status tailscale with repeated --node, --nodes-file, --node-user, --concurrency, --timeout-seconds, and --json.
• Probes only by reading runtime metadata, update status, and process state.
• Classifies nodes as healthy, unreachable, missing, wrong_app, wrong_channel, stale, or degraded.
• Exits 0 when all nodes are healthy, 2 when any node is unhealthy or unreachable, and 1 for local CLI/config errors.

Validation

• cargo fmt --check
• ./scripts/sync-surge-core-vendor.sh --check
• ./scripts/check-version-sync.sh
• cargo test -p surge-cli fleet_status
• cargo test -p surge-cli
• RUSTFLAGS="-D warnings" cargo test --workspace
• cargo clippy --all-targets --all-features -- -D warnings
• cargo clippy --workspace --lib --bins --examples -- -D warnings -D clippy::unwrap_used -D clippy::expect_used
• cargo clippy --workspace --all-targets --all-features -- -D warnings -W clippy::pedantic
• dotnet format dotnet/Surge.slnx --verify-no-changes --no-restore
• dotnet test dotnet/Surge.slnx --configuration Release
• Placeholder smoke: surge fleet-status tailscale --app-id sample-app --rid linux-x64 --channel sample-channel --version 1.2.3 --node node-a --timeout-seconds 1 --json returned exit 2 with node-a classified as unreachable.

Migration Notes

No migration required.