Fix NordVPN DNS and Tailscale recovery interlock

skills/nordvpn-client/SKILL.md

@@ -44,9 +44,10 @@ node scripts/nordvpn-client.js status --debug
   - the generated WireGuard config stays free of `DNS = ...`
   - `connect` now requires a bounded persistence gate plus a verified exit before success is declared
   - the skill snapshots and applies NordVPN DNS only to eligible physical services while connected
-  - NordVPN DNS is applied only after the tunnel remains up and the final liveness check still shows the requested exit
+  - NordVPN DNS is applied only after the tunnel remains up, the final liveness check still shows the requested exit, and system hostname resolution still works afterward
   - `disconnect` restores the saved DNS/search-domain state even if the tunnel state is stale
   - Tailscale is suspended before connect and resumed after disconnect or failed connect
+  - the skill writes a short-lived Tailscale suppression marker during VPN connect so host watchdogs do not immediately re-run `tailscale up`
   - `NordVPN.app` may remain installed but is only the manual fallback
 
 ## Credentials
@@ -96,7 +97,7 @@ Operational note:
 
 ## Output Rules
 
-- normal JSON output redacts local path metadata
+- normal JSON output redacts local path metadata and helper-hardening diagnostics
 - use `--debug` only when deeper troubleshooting requires internal local paths and helper/config metadata
 
 ## Troubleshooting Cues