hscontrol/servertest: fix test expectations for eventual consistency

Three corrections to issue tests that had wrong assumptions about
when data becomes available:

1. initial_map_should_include_peer_online_status: use WaitForCondition
   instead of checking the initial netmap. Online status is set by
   Connect() which sends a PeerChange patch after the initial
   RegisterResponse, so it may not be present immediately.

2. disco_key_should_propagate_to_peers: use WaitForCondition. The
   DiscoKey is sent in the first MapRequest (not RegisterRequest),
   so peers may not see it until a subsequent map update.

3. approved_route_without_announcement: invert the test expectation.
   Tailscale uses a strict advertise-then-approve model -- routes are
   only distributed when the node advertises them (Hostinfo.RoutableIPs)
   AND they are approved. An approval without advertisement is a dormant
   pre-approval. The test now asserts the route does NOT appear in
   AllowedIPs, matching upstream Tailscale semantics.

Also fix TestClient.Reconnect to clear the cached netmap and drain
pending updates before re-registering. Without this, WaitForPeers
returned immediately based on the old session's stale data.

hscontrol/servertest/client.go

@@ -266,6 +266,25 @@ func (c *TestClient) Reconnect(tb testing.TB) {
 		}
 	}
 
+	// Clear stale netmap data so that callers like WaitForPeers
+	// actually wait for the new session's map instead of returning
+	// immediately based on the old session's cached state.
+	c.mu.Lock()
+	c.netmap = nil
+	c.mu.Unlock()
+
+	// Drain any pending updates from the old session so they
+	// don't satisfy a subsequent WaitForPeers/WaitForUpdate.
+	for {
+		select {
+		case <-c.updates:
+		default:
+			goto drained
+		}
+	}
+
+drained:
+
 	// Re-register and start polling again.
 	c.register(tb)