On backends that can't do OS-level split DNS, the "." default route comes
from the system's own resolvers. If tailscaled reads them before the OS
has populated them (e.g. before NetworkManager/systemd-resolved run at
boot), it would point the OS at 100.100.100.100 with an empty "." route
and SERVFAIL all non-Tailscale DNS. Track base-config readiness as
explicit Manager state, withhold takeover while empty, and re-probe until
resolvers appear, driven by a backing-off retry timer (general) and a
resolv.conf-change event (Linux direct-mode fast path).
Fixes#20341
Signed-off-by: Brendan Creane <bcreane@gmail.com>
e9733d0de5