Share and trust on macOS #43

grove share and grove trust (#41) are Linux-only. platform.TailscaleSocket returns nothing on darwin, so both commands stop with "Linux-only for now", and the daemon never starts sharing.

What macOS needs

• Reaching tailscaled. Grove talks to tailscaled's local API over its unix socket. On Linux that's /var/run/tailscale/tailscaled.sock. On macOS it depends on the build: the open-source tailscaled has a socket, but the App Store and standalone apps expose the local API differently, over a TCP port with a token found through the app's sandbox. That's the main work.
• Binding the resolver. Split DNS needs port 53 on the tailnet address. Linux lowers the unprivileged port floor. macOS can't, so this needs the same kind of answer as 443, a pf redirect or similar, scoped to the tailnet address.
• Serve and Taildrop use the same local API calls, so they should come along once the API is reachable.
• Trust already works through truststore on macOS, so grove trust <host> mostly needs the peer fetch, which is plain HTTPS to a tailnet IP.

Worth knowing

t3code reads Tailscale status on macOS by spawning the CLI, and had to cache it for 60 seconds because each spawn of the App Store CLI triggers a permission prompt. Polling every ten seconds, the way the Linux daemon does, would hit the same problem.