Tailscale SSH "check" mode prints an approval link on stderr and holds
the session open until someone approves it. T3 read ssh stderr only
after exit, so the link never reached the user and the connection sat
on "Reconnecting" forever on hosts where tailscaled cannot open a
browser itself.

Read stderr while ssh runs, open the link once from the desktop app,
and fail retries for the same host right away with the link instead of
queuing them behind the held session, so the Connections row shows it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>