fix: add tailnet smoke checks and move Tailscale operator to stable

Add a post-deploy smoke test that validates Tailscale DNS, proxy readiness,
reachability, and service responses for Rancher, Grafana, and Prometheus.
Move the operator to the stable Helm repo/version and align the baseline docs
with the current HA private-only architecture.

.gitea/workflows/deploy.yml

@@ -406,6 +406,13 @@ jobs:
         env:
           ANSIBLE_HOST_KEY_CHECKING: "False"
 
+      - name: Post-deploy tailnet smoke checks
+        working-directory: ansible
+        run: |
+          ansible -i inventory.ini 'control_plane[0]' -m script -a "../scripts/smoke-check-tailnet-services.sh"
+        env:
+          ANSIBLE_HOST_KEY_CHECKING: "False"
+
       - name: Upload Kubeconfig
         uses: actions/upload-artifact@v3
         with: