[bug] Coder Connect on Windows: DNS publishing silently fails — workspace lookups return empty answers despite Connect being on

**Version:** 0.8.3 (latest)
**OS:** Windows 11 Pro 10.0.26200

## Symptom

Coder Desktop GUI reports Connect is ON, workspaces are listed, but no workspace hostname (`.coder`) actually resolves via DNS. Apps that rely on Coder Connect for hostname routing (in our case, Claude Desktop's bundled SSH client which cannot use `~/.ssh/config` `ProxyCommand`) time out at the SSH handshake step because no IP is returned.

## What's set up correctly

- Wintun adapter "Coder" is `Up` with a `fd60:627a:a42b::/64` IPv6 prefix
- `Get-DnsClientNrptRule` shows `.coder → fd60:627a:a42b::53`
- TCP/53 on the Coder DNS server is reachable
- `coder users show me` succeeds — CLI is authenticated to our deployment

## What fails

Direct query to the embedded DNS:

```powershell
> Resolve-DnsName -Name myworkspace.coder -Server fd60:627a:a42b::53
(empty answer — no IPAddress, no NXDOMAIN)

> ssh -F nul -o ConnectTimeout=15 coder@myworkspace.coder "echo OK"
ssh: Could not resolve hostname myworkspace.coder: No such host is known.
```

Queries succeed only when going via the `~/.ssh/config` `ProxyCommand` (`coder.exe ssh --stdio`) — i.e., bypassing Coder Connect entirely. OpenSSH with verbose shows `Authenticated to myworkspace.coder (via proxy)`.

## Additional observation

Restarting the "Coder Desktop" Windows service while signed in **deletes** the Wintun adapter, the NRPT rule, and the `CoderVpnService` entry. Recovery requires toggling Connect OFF/ON in the tray app — the service restart alone leaves the system in a broken state.

## Impact

Any third-party app that integrates with Coder via direct DNS + TCP (no `ProxyCommand` support) — e.g., Claude Desktop's "Add SSH connection" feature — cannot reach workspaces, even when the GUI says Connect is healthy.

Reproduisez l’échec avec Resolve-DnsName sur fd60:627a:a42b::53, puis inspectez le Coder Connect Windows service, le Wintun adapter, la NRPT rule et le comportement de CoderVpnService. C’est terminé lorsque les requêtes vers workspace.coder renvoient une adresse IP et que le redémarrage du Coder Desktop service préserve l’adaptateur, la règle et l’enregistrement du service.

Rédigé par le modèle d'indexation à partir du texte de l'issue.