Add scripts/expose.sh: tailcat tunnel for remote access

tailcat (Tailscale data plane, no control plane) forwards the VM's
web UI and SSH ports to another machine via a stable saved-key
address; outbound-only, so it works through the nested slirp NAT.

scripts/expose.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Expose the turnstone VM to another machine via tailcat (Tailscale's
+# data plane without its control plane — outbound-only, works through
+# the nested slirp NAT).
+#
+#   scripts/expose.sh            # foreground; ctrl-c to stop
+#
+# Prints a stable tailcat address (saved key at
+# ~/.config/tailcat/keys/default.private.json). On the client machine:
+#
+#   tailcat forward <tc-address> 8080:8080 2222:2222
+#
+# then browse http://localhost:8080 and ssh -p 2222 as usual.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+TC="${TAILCAT_BIN:-$HOME/.local/bin/tailcat}"
+PORTS="${TAILCAT_PORTS:-8080,2222}"
+
+if ! command -v "$TC" >/dev/null 2>&1; then
+  echo "tailcat not found at $TC" >&2
+  echo "install it first: https://github.com/tailscale/tailcat (INSTALL.md)" >&2
+  exit 1
+fi
+
+# Stable address across restarts: create the saved key once
+if [ ! -f "$HOME/.config/tailcat/keys/default.private.json" ]; then
+  "$TC" genkey --key=default
+fi
+
+exec "$TC" serve --key=default "$PORTS"