[selectarget]

When a Tailscale outbound uses dialer-proxy, tsnet requests an unbound UDP listener such as :0. The listener currently passes an invalid netip.AddrPort{} to the proxy dialer. With Mihomo DNS enabled, proxy adapters can try to resolve an empty destination and fail with can't resolve ip: couldn't find ip, preventing Tailscale from starting.

This change supplies a valid unspecified IPv4/IPv6 address and port zero when creating the proxied UDP association. Each subsequent WriteTo still carries its real destination. A small PacketConn wrapper converts proxy address wrappers into the IP/port addresses expected by Tailscale, preserving a usable local address when available. WriteTo, close, and deadline operations remain delegated to the original proxy connection. The listener path without dialer-proxy is unchanged.

Validation:

• go test -tags with_gvisor ./adapter/outbound -count=1 -timeout 180s passed on the current Alpha development branch.
• Regression coverage includes the invalid-address failure, UDP payload round trips to two different destinations on one association, address normalization, IPv6 loopback listener initialization, and rejection of non-UDP listeners.
• With this runtime patch applied to v1.19.32 on Windows amd64 (Go 1.26.8, with_gvisor), a separate patched executable used a real Hysteria2 upstream bound to the physical network interface. STUN servers in Tokyo and Los Angeles observed that upstream's IPv4 egress.
• Actual Tailscale SSH commands succeeded against four Linux VPS instances and one NAS through the patched executable. Remote peer status confirmed the proxy's public UDP endpoint on the US VPS, both other VPS instances, and the NAS. The VPS hosting the upstream was also reachable over SSH.
• The existing embedded node was paused during the test. After stopping the candidate, the original direct-transport configuration was restored and all five SSH checks passed again. The installed core binary was unchanged.

The real upstream has IPv4 connectivity only, so the successful manual test used IPv4 DNS resolution via DoH through that upstream. Remote IPv6 egress and other upstream proxy protocols have not been validated.

Fixes #3142.