#2936 @swamp/tailscale: follow-ups from the initial release verification review

Non-blocking findings from the final verification review of the initial @swamp/tailscale release (swamp-club #2933, commit dfd5549). The gate passed; these were deferred so the release could ship.

Medium:

• Collection delete given an id the definition does not track writes its deletion record to the instance named by the id, while get and list write that resource as item-. After list then delete of that id, the item- instance still shows it as live. Fix: write the record to item- in the untracked branch (codegen/tailscale/extensionModelGenerator.ts, collection delete).

Low:

• Numeric enum literals are emitted unquoted (z.literal of the raw value); a mixed string and number enum would not compile. Use JSON.stringify.
• instanceName lets a bare . through; map it to an underscore.
• Keyed delete and sync records interpolate the key argument name without propKey.
• The schema fetch in fetchTailscaleSchema has no request timeout.
• Keyed create (service, log_stream) has a read-then-PUT race: two concurrent creates can both pass the existence check. The API upsert offers no guard; document or accept.

Also from earlier rounds, deferred: OAuth client auth, device facets, services, log streams, posture integrations, OAuth apps and invites have not been exercised against a live tailnet.