[bug] Coder Connect on Windows: DNS publishing silently fails — workspace lookups return empty answers despite Connect being on

**Version:** 0.8.3 (latest)
**OS:** Windows 11 Pro 10.0.26200

## Symptom

Coder Desktop GUI reports Connect is ON, workspaces are listed, but no workspace hostname (`.coder`) actually resolves via DNS. Apps that rely on Coder Connect for hostname routing (in our case, Claude Desktop's bundled SSH client which cannot use `~/.ssh/config` `ProxyCommand`) time out at the SSH handshake step because no IP is returned.

## What's set up correctly

- Wintun adapter "Coder" is `Up` with a `fd60:627a:a42b::/64` IPv6 prefix
- `Get-DnsClientNrptRule` shows `.coder → fd60:627a:a42b::53`
- TCP/53 on the Coder DNS server is reachable
- `coder users show me` succeeds — CLI is authenticated to our deployment

## What fails

Direct query to the embedded DNS:

```powershell
> Resolve-DnsName -Name myworkspace.coder -Server fd60:627a:a42b::53
(empty answer — no IPAddress, no NXDOMAIN)

> ssh -F nul -o ConnectTimeout=15 coder@myworkspace.coder "echo OK"
ssh: Could not resolve hostname myworkspace.coder: No such host is known.
```

Queries succeed only when going via the `~/.ssh/config` `ProxyCommand` (`coder.exe ssh --stdio`) — i.e., bypassing Coder Connect entirely. OpenSSH with verbose shows `Authenticated to myworkspace.coder (via proxy)`.

## Additional observation

Restarting the "Coder Desktop" Windows service while signed in **deletes** the Wintun adapter, the NRPT rule, and the `CoderVpnService` entry. Recovery requires toggling Connect OFF/ON in the tray app — the service restart alone leaves the system in a broken state.

## Impact

Any third-party app that integrates with Coder via direct DNS + TCP (no `ProxyCommand` support) — e.g., Claude Desktop's "Add SSH connection" feature — cannot reach workspaces, even when the GUI says Connect is healthy.

Reproduce the failure with Resolve-DnsName against fd60:627a:a42b::53, then inspect the Coder Connect Windows service, Wintun adapter, NRPT rule, and CoderVpnService behavior. Done means workspace.coder queries return an IP address and restarting the Coder Desktop service preserves the adapter, rule, and service registration.

Escrito por el modelo de indexación a partir del texto del issue.