Surface VPN connection status in the deploy job so netbird failures are legible instead of a cryptic DeadlineExceeded: - Pre-flight check for /dev/net/tun + NET_ADMIN before connecting - id + timeout-minutes:3 on Netbird Connect to bound its wait loop - Post-connect 'netbird status --detail' with a Management:Connected assert - Always-run diagnostics + 'netbird down' teardown