integration: HA cable-pull lifecycle test

Add DisconnectFromNetwork/ReconnectToNetwork on TailscaleClient
backed by pool.Client.DisconnectNetwork.

Exercise single-router fail+recover either side, sequential dual
failure, and simultaneous dual failure. The dual-failure legs
assert no flap to a known-bad primary; the single-router-return
legs check traffic only because docker network disconnect
transiently fails probes on sibling routers.

Fails on parent; passes after the fix.

Updates #3203

integration/dockertestutil/network.go

@@ -91,6 +91,47 @@ func AddContainerToNetwork(
 	return nil
 }
 
+// DisconnectContainerFromNetwork removes the container from network at
+// the docker daemon level. Mirrors a physical cable pull: the
+// container's network interface for that network disappears and any
+// in-flight TCP connections are left half-open, exactly the failure
+// mode iptables-based simulations cannot reproduce.
+func DisconnectContainerFromNetwork(
+	pool *dockertest.Pool,
+	network *dockertest.Network,
+	testContainer string,
+) error {
+	containers, err := pool.Client.ListContainers(docker.ListContainersOptions{
+		All: true,
+		Filters: map[string][]string{
+			"name": {testContainer},
+		},
+	})
+	if err != nil {
+		return err
+	}
+
+	if len(containers) == 0 {
+		return fmt.Errorf("%w: %s", ErrContainerNotFound, testContainer)
+	}
+
+	return pool.Client.DisconnectNetwork(network.Network.ID, docker.NetworkConnectionOptions{
+		Container: containers[0].ID,
+		Force:     true,
+	})
+}
+
+// ReconnectContainerToNetwork is the inverse of
+// DisconnectContainerFromNetwork — re-attaches the container to the
+// network so traffic can flow again.
+func ReconnectContainerToNetwork(
+	pool *dockertest.Pool,
+	network *dockertest.Network,
+	testContainer string,
+) error {
+	return AddContainerToNetwork(pool, network, testContainer)
+}
+
 // RandomFreeHostPort asks the kernel for a free open port that is ready to use.
 // (from https://github.com/phayes/freeport)
 func RandomFreeHostPort() (int, error) {