**Gives `pibox` the same tailnet egress wiring `claudebox` and `pibox-zai` already had.** - `pibox` joins the tailnet egress overlay, so it gets the split DNS and route helper the other two agent containers get when `TAILSCALE=1` is on. Without it the service reached the tailnet only on hosts that already route `100.64.0.0/10` themselves, and had no tailnet access at all on a host that is not a tailnet node.