fix(agent/windows): add --unattended to tailscale up

On Windows tailscaled stops the backend when the CLI client disconnects.
--unattended keeps the VPN session alive so the agent can report its IP
and the server can reach the node. Bump to v0.3.3.

agent/tailscale.go

@@ -104,7 +104,10 @@ func startTailscale(dataDir, nodeID, headscaleURL, authKey string) (string, erro
 		"--hostname=" + nodeID,
 		"--accept-dns=false",
 	}
-	if runtime.GOOS != "windows" {
+	if runtime.GOOS == "windows" {
+		// On Windows, keep the VPN up even after the tailscale.exe CLI client disconnects.
+		upArgs = append(upArgs, "--unattended")
+	} else {
 		// --operator is only meaningful on Unix systems.
 		upArgs = append(upArgs, "--operator=root")
 	}