fix: simplify mac nordvpn tailscale coordination

skills/nordvpn-client/SKILL.md

@@ -42,7 +42,11 @@ node scripts/nordvpn-client.js disconnect
   - `install` bootstraps those tools with Homebrew
   - equivalent Homebrew command: `brew install wireguard-go wireguard-tools`
   - `login` validates `NORDVPN_TOKEN` / `NORDVPN_TOKEN_FILE` for the WireGuard backend
-  - the generated WireGuard config intentionally omits `DNS = ...` so `wg-quick` does not rewrite system resolvers or break other interfaces such as Tailscale
+  - the generated WireGuard config uses NordVPN DNS directly:
+    - `103.86.96.100`
+    - `103.86.99.100`
+  - before connect, the skill automatically stops Tailscale if it is active
+  - after disconnect, or after a failed connect, the skill brings Tailscale back up if it stopped it
   - `NordVPN.app` can remain installed, but it is only the manual fallback
 
 ## Credentials
@@ -98,5 +102,6 @@ For an automated macOS flow:
   - `wireguard-go`
   - `wireguard-tools`
   - non-interactive `sudo` for `~/.openclaw/workspace/skills/nordvpn-client/scripts/nordvpn-wireguard-helper.sh`
+- On macOS, Tailscale is intentionally suspended during an automated NordVPN session and resumed afterward.
 - `NordVPN.app` login on macOS is not reused by the WireGuard backend.
 - The Homebrew `nordvpn` app does not need to be uninstalled. It can coexist with the WireGuard backend.