Add Tailscale DNS hint for agent failures

[nwparker]

Summary

• Detect macOS configurations where Tailscale MagicDNS (100.100.100.100) is the only global resolver
• Add a targeted DNS hint to Claude/Codex rate-limit and AI text-generation failures when stderr/output looks like DNS or websocket lookup trouble
• Cover MagicDNS-only parsing and the Codex lookup error from [Bug]: WebSocket connections fail when Tailscale MagicDNS is the sole DNS resolver #2687 with focused tests

Notes

This does not force Claude/Codex API transports to use a different resolver. Orca does not own those third-party websocket transports, so this PR surfaces the actionable system DNS remediation when the reported failure shape appears.

Refs #2687

Test plan

• pnpm exec vitest run --config config/vitest.config.ts src/main/network/macos-tailscale-dns-diagnostic.test.ts
• pnpm run typecheck:node
• pnpm exec oxlint src/main/network/macos-tailscale-dns-diagnostic.ts src/main/network/macos-tailscale-dns-diagnostic.test.ts src/main/rate-limits/codex-fetcher.ts src/main/rate-limits/claude-pty.ts src/main/rate-limits/claude-fetcher.ts src/main/text-generation/commit-message-text-generation.ts
• git diff --check