Problem

Portless currently routes through the local builtin proxy and .localhost domains only.
Teams using Tailscale need a first-class way to expose dev apps via tailnet URLs.

Proposal

Add a provider model with:

• builtin (current default behavior)
• tailscale (new, via tailscale serve path mounts)

Usage:

• portless --provider tailscale <name> <cmd...>
• URL shape: https://<node>.<tailnet>.ts.net/<name>

Scope

• Global provider selection:
  • --provider <builtin|tailscale>
  • PORTLESS_PROVIDER=<builtin|tailscale>
• Tailscale app lifecycle:
  • register tailscale serve path on start
  • remove path on process exit
  • support --force to replace conflicting path
• Provider-aware route state and portless list
• Builtin-only guards for portless proxy ... and portless trust
• Docs/help updates:
  • README.md
  • skills/portless/SKILL.md
  • packages/portless/src/cli.ts help output

Out of Scope

• Funnel/public internet exposure
• Full proxy start/stop parity in tailscale mode

Acceptance Criteria

• Builtin default behavior remains unchanged
• Tailscale provider works with portless --provider tailscale <name> <cmd...>
• portless list shows routes for active provider
• Tests cover tailscale adapter behavior, provider CLI behavior, and route schema compatibility

Related

• Prior plan PR (closed, unmerged): Plan: Add Tailscale IP & MagicDNS support for Portless #7