feat: add notnet crate and YubikeySource, thread Tailscale into notstrap
- New crates/notnet: TailscaleOptions, ensure_connected(), auth key chain
(TS_AUTHKEY env → YubiKey PIV 9d → interactive prompt), install via
apt/brew/pacman or official install.sh, peer reachability verification
- notsecrets: YubikeySource implementing IdentitySource, reads age key from
PIV slot 9c; gated behind optional `yubikey` feature
- notstrap: Tailscale step inserted between prerequisites and clone;
BootstrapOptions.tailscale controls override/skip; NotstrapConfig gains
optional [tailscale] section; dotfiles_repo is now Option<String> (Tailscale
gitea_url takes precedence); identity chain adds YubikeySource before
Bitwarden
- Updated workspace Cargo.toml: notnet added to members and workspace deps
- Integration tests: tailscale: Some(None) to skip Tailscale in all test opts
c7c074d48b