[bug] Coder Connect on Windows: DNS publishing silently fails — workspace lookups return empty answers despite Connect being on

**Version:** 0.8.3 (latest)
**OS:** Windows 11 Pro 10.0.26200

## Symptom

Coder Desktop GUI reports Connect is ON, workspaces are listed, but no workspace hostname (`.coder`) actually resolves via DNS. Apps that rely on Coder Connect for hostname routing (in our case, Claude Desktop's bundled SSH client which cannot use `~/.ssh/config` `ProxyCommand`) time out at the SSH handshake step because no IP is returned.

## What's set up correctly

- Wintun adapter "Coder" is `Up` with a `fd60:627a:a42b::/64` IPv6 prefix
- `Get-DnsClientNrptRule` shows `.coder → fd60:627a:a42b::53`
- TCP/53 on the Coder DNS server is reachable
- `coder users show me` succeeds — CLI is authenticated to our deployment

## What fails

Direct query to the embedded DNS:

```powershell
> Resolve-DnsName -Name myworkspace.coder -Server fd60:627a:a42b::53
(empty answer — no IPAddress, no NXDOMAIN)

> ssh -F nul -o ConnectTimeout=15 coder@myworkspace.coder "echo OK"
ssh: Could not resolve hostname myworkspace.coder: No such host is known.
```

Queries succeed only when going via the `~/.ssh/config` `ProxyCommand` (`coder.exe ssh --stdio`) — i.e., bypassing Coder Connect entirely. OpenSSH with verbose shows `Authenticated to myworkspace.coder (via proxy)`.

## Additional observation

Restarting the "Coder Desktop" Windows service while signed in **deletes** the Wintun adapter, the NRPT rule, and the `CoderVpnService` entry. Recovery requires toggling Connect OFF/ON in the tray app — the service restart alone leaves the system in a broken state.

## Impact

Any third-party app that integrates with Coder via direct DNS + TCP (no `ProxyCommand` support) — e.g., Claude Desktop's "Add SSH connection" feature — cannot reach workspaces, even when the GUI says Connect is healthy.