macOS fleet reliability: runner nodes recover from Unknown, xcresult processors self-recover from tailscale/NAT outages

Infrastructure resilience fixes that prevent the macos-fleet from silently stranding builds and stalling xcresult processing. After a fleet-wide kubelet restart, tart-kubelet nodes stuck in Ready=Unknown can now self-recover (the kubelet restores Ready=True when heartbeat resumes), so scheduling resumes. On the xcresult processor, tailscale up is now bounded to 60s, so a Tailscale control-plane hiccup no longer hangs the launchd boot chain indefinitely and now self-recovers via KeepAlive. The macos-host NAT now asserts the general-internet leg from the durable vmnat anchor (re-run every 60s), addressing the root cause of a recent incident where VMs stopped egressing and processor VMs silently stopped consuming for hours.