docs(wiki): add Tailscale client-management pattern + GuruRMM enroll script

One tailnet per client (never merge into ACG own tailnet), MSP holds Admin,
devices enrolled as tagged nodes via pre-auth keys pushed from GuruRMM.
Includes tailscale-client-enroll.ps1 (idempotent unattended Windows MSI
install + tagged auth-key join), a see-each-other tag ACL, the Windows
subnet-routing reality (userspace/netstack, not the old IP-forward hack),
and a runbook. Indexed under wiki Patterns.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

wiki/index.md

@@ -76,7 +76,7 @@ Run `/wiki-lint` to check for stale entries and broken backlinks.
 
 | Article | Summary | Last Compiled |
 |---|---|---|
-| *(none yet — patterns will be extracted during system/project compilation passes)* | | |
+| [Tailscale client management](patterns/tailscale-client-management.md) | One tailnet per client (never merge into yours); you hold Admin; enroll devices as tagged nodes via pre-auth keys pushed from GuruRMM ([enroll script](patterns/tailscale-client-enroll.ps1)). Windows subnet-routing reality + "see each other" ACL. | 2026-06-06 |
 
 ---