Dogfood finding #2: createTailscaleProvider() built with coordClient=null; nothing in prod ever called attachCoordClient() (the wiring the provider docblock promised never landed), so wizard credential validation always failed not_configured even with a valid stored token. Pass a delegating proxy that fetches a fresh coord client per call via the sanctioned ctx.tailscaleCoord.getClient pattern (token re-read from credentialManager each call). Full suite 3413/3413.