tailscale netcheck: UDP false, no IPv4, DERP unreachable on Linux - regression in 1.96.4 (works on 1.94.2)

### What is the issue?

After upgrading Tailscale to 1.96.4 on all nodes in a Proxmox cluster, `tailscale netcheck` reports `UDP: false`, no IPv4 address found, and DERP servers are unreachable. The coordination server warning appears in tailscale status:
> Unable to connect to the Tailscale coordination server to synchronize the state of your tailnet. Peer reachability might degrade over time.

Downgrading to 1.94.2 immediately resolves the issue without any other configuration changes.

### Steps to reproduce

1. Run Tailscale 1.94.2 on a Linux host (Proxmox 9.1.1, Debian-based)
2. Upgrade to 1.96.4
3. Restart `tailscaled`
4. Run `tailscale netcheck`, observe `UDP: false`, no IPv4 address, no DERP latency results
5. Downgrade back to 1.94.2 and restart `tailscaled`, observe `UDP: true` and correct IPv4/DERP results

### Are there any recent changes that introduced the issue?

Regression introduced between 1.94.2 and 1.96.4. Issue is reproducible across all nodes in the cluster.

### OS

Linux

### OS version

Proxmox 9.1.1 (Debian-based)

### Tailscale version

1.96.4

### Other software

#### Environment details

Proxmox 9.1.1 cluster (nodes: nbg1, fsn1, fsn2, ams1)

Proxmox SDN routed over Tailscale, SDN VNet has SNAT enabled.

All guests use the public IP of the host

NAT rules redirect public IP to per-host OPNsense router (also a Tailscale node):
```
post-up iptables -t nat -A PREROUTING -i vmbr10 -p tcp -m multiport ! --dport 22,8006,41641 -j DNAT --to 10.0.0.1
post-up iptables -t nat -A PREROUTING -i vmbr10 -p udp -m multiport ! --dport 41641 -j DNAT --to 10.0.0.1
```

`tcpdump` shows STUN packets on port 3478 are sent and received on the correct interface, but netcheck still reports `UDP: false`

Issue persists even with all guest Tailscale nodes shut down

#### Diagnostics

`tailscale netcheck` on 1.96.4:
```
Report:
* Time: 2026-04-06T10:26:52.000446548Z
* UDP: false
* IPv4: (no addr found)
* IPv6: no, but OS has support
* MappingVariesByDestIP:
* PortMapping:
* CaptivePortal: false
* Nearest DERP: unknown (no response to latency probes)
```

`tailscale netcheck` on 1.94.2:
```
Report:
* Time: 2026-04-06T10:55:15.328624971Z
* UDP: true
* IPv4: yes, 138.xxx.xxx.xxx:36260
* IPv6: no, but OS has support
* MappingVariesByDestIP: false
* PortMapping:
* Nearest DERP: Nuremberg
* DERP latency:
- nue: 2.7ms (Nuremberg)
...
```

### Bug report
```
BUG-aa1e2a5cb499269f02f107ff63f5c9ce6bc846d14dbc92036ee94aa306a052c2-20260406095912Z-d999bbd8c9e7cd75
BUG-aa1e2a5cb499269f02f107ff63f5c9ce6bc846d14dbc92036ee94aa306a052c2-20260406100029Z-c4c2a426943dbfd7
```

---

*Note: The issue was drafted from the kapa.ai support agent as I figured it might know what is relevant to include in the issue.*