fix: realign managed-tunnel design state with the 0.4.2 runtime

Point component:managed-tunnel at spawn_tunnel_supervisor and
start_tailscale_funnel_once now that start_managed_tunnel is gone, and
update the requirement, component, and acceptance wording from sequential
provider fallback to the concurrent background model with per-tunnel
self-healing. The send_imessage reference is intentionally left out: the
cfg-gated duplicate definitions cannot resolve to a unique symbol.

Author: francis-du

.wcode/design/acceptance.yaml

@@ -386,7 +386,7 @@
 - schema_version: 1
   id: AC-TUNNEL-001
   title: Managed tunnel selection supports free provider fallback
-  statement: The default tunnel policy tries bounded free providers in deterministic order, explicit provider values remain stable, Cloudflare URLs exclude the API host, localhost.run and Pinggy public hosts are parsed without accepting provider control hosts, and a candidate is accepted only after the public health response matches the current wcode instance.
+  statement: The default tunnel policy starts every provider concurrently and keeps each candidate only after the public health response matches the current wcode instance, explicit provider values remain stable, Cloudflare URLs exclude the API host, localhost.run and Pinggy public hosts are parsed without accepting provider control hosts, and Tailscale Funnel surfaces its enable URL when the tailnet has not enabled Funnel.
   verification:
     - kind: test
       path: src/runtime/tunnel.rs

.wcode/design/components.yaml

@@ -612,18 +612,22 @@
   name: Managed Public Tunnel Runtime
   responsibilities:
     - expose the local MCP runtime through temporary HTTPS providers without binding availability to one vendor
-    - auto-fallback across Cloudflare Quick Tunnel, localhost.run and Pinggy when process startup, URL discovery or instance-matched health verification fails
+    - start Cloudflare Quick Tunnel, localhost.run, Pinggy and Tailscale Funnel concurrently in the background so the dashboard never waits for a provider; retry unreachable providers on a fixed interval and keep every instance-health-verified tunnel live
+    - respawn a single dead tunnel after an exponential backoff without restarting the process or disturbing live tunnels, promoting the next live tunnel when the primary endpoint dies
     - keep explicit provider selection and stable --public-url overrides available without weakening OAuth or local health verification
     - isolate provider lifecycle, dependency checks, URL parsing and health verification from the top-level process bootstrap
   depends_on:
     - component:mcp-runtime
   implementation:
     - kind: symbol
       path: src/runtime/tunnel.rs
-      symbol: start_managed_tunnel
+      symbol: spawn_tunnel_supervisor
     - kind: symbol
       path: src/runtime/tunnel.rs
       symbol: start_ssh_tunnel_once
     - kind: symbol
       path: src/runtime/tunnel.rs
       symbol: extract_ssh_tunnel_url
+    - kind: symbol
+      path: src/runtime/tunnel.rs
+      symbol: start_tailscale_funnel_once

.wcode/design/requirements.yaml

@@ -471,7 +471,7 @@
 - schema_version: 1
   id: REQ-TUNNEL-001
   title: Public tunnel availability is provider-resilient
-  intent: Remote MCP startup must not depend on one tunnel vendor; wcode must support bounded automatic failover across free HTTPS tunnel providers while preserving exact instance health verification, explicit provider selection, OAuth and stable external reverse-proxy overrides.
+  intent: Remote MCP startup must not depend on one tunnel vendor; wcode must start the free HTTPS tunnel providers and Tailscale Funnel concurrently in the background, keep every instance-health-verified tunnel live, and self-heal single-tunnel failures without a process restart, while preserving exact instance health verification, explicit provider selection, OAuth and stable external reverse-proxy overrides.
   priority: high
   implemented_by:
     - component:managed-tunnel