Fixes the 2026-08-07 install incident where bringing .7 up as a subnet router
with --accept-routes blackholed its own L3 (it imported a route sending its
own return traffic for the advertised /22 into tailscale0) and locked us out.

- install: DROP --accept-routes (a subnet router advertises, it does not need
  to consume routes); pass the pre-auth key via --authkey=file:<path> so the
  secret never lands on argv / in ps (the key leaked that way during the
  incident).
- check: add two assertions, each with a failing-direction fixture --
  own-subnet-not-routed-via-tailscale0 (the blackhole guard) and control-plane
  reachability (live HTTP from $LOGIN_SERVER, not just DNS).

Validated LIVE: advertise-only re-join brought .7 up Running/Online (TSIP
100.64.0.57) with its own subnet NOT hijacked and no lockout; route now awaits
Headscale approval. Harness 27/0, gauntlet ALL GREEN (102), repo-lint 0-fail.
Body: docs/changelog-20260807-dc0-tailscale-install.md (UPDATE section).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728