fix: harden tailnet smoke script

scripts/smoke-check-tailnet-services.sh

@@ -1,6 +1,12 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+if kubectl get --raw=/readyz >/dev/null 2>&1; then
+  KUBECTL=(kubectl)
+else
+  KUBECTL=(sudo k3s kubectl)
+fi
+
 retry() {
   local attempts="$1"
   local delay_seconds="$2"
@@ -20,7 +26,7 @@ service_proxy_ready() {
   local namespace="$1"
   local service_name="$2"
 
-  kubectl get svc "$service_name" -n "$namespace" \
+  "${KUBECTL[@]}" get svc "$service_name" -n "$namespace" \
     -o jsonpath='{.status.conditions[?(@.type=="TailscaleProxyReady")].status}' 2>/dev/null \
     | grep -qx 'True'
 }
@@ -30,7 +36,7 @@ assigned_hostname_matches() {
   local service_name="$2"
   local expected_hostname="$3"
 
-  kubectl get svc "$service_name" -n "$namespace" \
+  "${KUBECTL[@]}" get svc "$service_name" -n "$namespace" \
     -o jsonpath='{.status.loadBalancer.ingress[0].hostname}' 2>/dev/null \
     | grep -qx "$expected_hostname"
 }
@@ -42,7 +48,7 @@ dns_resolves() {
 
 tailscale_ping_succeeds() {
   local hostname="$1"
-  tailscale ping -c 1 "$hostname" >/dev/null 2>&1
+  timeout 20s tailscale ping -c 1 "$hostname" >/dev/null 2>&1
 }
 
 http_status_is_expected() {