fix: recover an already active Funnel

[RyleaStark]

Root cause

After the update finally completed, Tailscale Funnel was already active on the correct RC35+ alias but the durable registry still said tailnet_lock. Continuation always invoked Funnel enablement before reading current provider state, so stale pending rows could time out despite the exact desired Funnel already being live.

Fix

• inspect provider-native Funnel state after exact identity, approval, and prerequisite validation
• when the current route already matches the deployment origin, persist the connection as connected without replaying provider side effects
• preserve normal enablement when no matching route exists
• prepare immutable 0.4.0.rc38

Validation

• durable approval recovery with an existing exact Funnel performs zero enable calls and becomes connected
• ordinary fresh onboarding still invokes enable
• disabled prerequisites clear the fake provider state before later re-enable
• failed post-enable reconciliation remains fail-closed
• 52 focused Tailscale service tests and Ruff pass