hscontrol: replace tailscale line refs with doc links

Line numbers drift on every upstream bump.

0.29's tailscale has no tailcfg/nodecap package, so the constants keep their
tailcfg names here.

(cherry picked from commit 06fa3075da)

hscontrol/app.go

@@ -233,8 +233,7 @@ func NewHeadscale(cfg *types.Config) (*Headscale, error) {
 			// DNS routes vanish, taking the resolver with them for ~6 min
 			// until the next route-changing netmap. Empty slice survives
 			// Clone and carries the same "resolve locally" semantics
-			// (tailscale.com/ipn/ipnlocal/node_backend.go:869 documents the
-			// empty-resolver Routes form for Issue 2706).
+			// ([tailcfg.DNSConfig.Routes] documents the empty-resolver form).
 			app.cfg.TailcfgDNSConfig.Routes[d.WithoutTrailingDot()] = []*dnstype.Resolver{}
 		}
 	}

hscontrol/mapper/builder.go

@@ -307,7 +307,8 @@ func (b *MapResponseBuilder) buildTailPeers(peers views.Slice[types.NodeView]) (
 		// [tailcfg.Node.CapMap] on a peer carries the small set of
 		// caps the Tailscale client reads from the peer view rather
 		// than the self view (suggest-exit-node, dns-subdomain-resolve
-		// — see ipn/ipnlocal/local.go:7534 and node_backend.go:745).
+		// — see [tailcfg.NodeAttrSuggestExitNode] and
+		// [tailcfg.NodeAttrDNSSubdomainResolve]).
 		// The Tailscale-hosted control plane stamps these only when
 		// the peer satisfies the cap's emission condition; every other
 		// cap stays off the peer view, leaving CapMap empty for most

hscontrol/policy/v2/tailnet_state_caps.go

@@ -91,20 +91,21 @@ var unmodelledTailnetStateCaps = []tailcfg.NodeCapability{
 
 	// [tailcfg.CapabilityTailnetLock]: tailnet-lock signs node keys
 	// with a tailnet-wide signing key so peers can detect silent
-	// re-keying by the control plane. Client reads at
-	// ipn/ipnlocal/local.go:1752 (b.capTailnetLock). Headscale has no
-	// tailnet-lock implementation.
+	// re-keying by the control plane. Client gates
+	// [tailscale.com/ipn/ipnlocal.LocalBackend.NetworkLockStatus] on it.
+	// Headscale has no tailnet-lock implementation.
 	tailcfg.CapabilityTailnetLock,
 
 	// [tailcfg.NodeAttrServiceHost]: marks a node as approved to host
-	// VIP services (Tailscale Services). Client reads via
-	// UnmarshalNodeCapViewJSON at ipn/ipnlocal/local.go:2704.
+	// VIP services (Tailscale Services). Client decodes it via
+	// [tailcfg.UnmarshalNodeCapViewJSON] into [tailcfg.ServiceIPMappings].
 	// Headscale does not implement Tailscale Services.
 	tailcfg.NodeAttrServiceHost,
 
 	// [tailcfg.NodeAttrStoreAppCRoutes]: tells an app-connector node
 	// to persist learned routes across restarts. Client reads via
-	// controlknobs:148. Headscale does not implement app connectors.
+	// [tailscale.com/control/controlknobs.Knobs.UpdateFromNodeAttributes]. Headscale does not implement app
+	// connectors.
 	tailcfg.NodeAttrStoreAppCRoutes,
 
 	// [tailcfg.CapabilityWarnFunnelNoHTTPS]: deprecated in Tailscale
@@ -138,7 +139,8 @@ var unmodelledTailnetStateCaps = []tailcfg.NodeCapability{
 
 	// [tailcfg.NodeAttrProbeUDPLifetime]: tunes magicsock's UDP
 	// path-lifetime probe behavior. Internal performance knob; not
-	// policy-driven. Client reads via controlknobs:147.
+	// policy-driven. Client reads via
+	// [tailscale.com/control/controlknobs.Knobs.UpdateFromNodeAttributes].
 	tailcfg.NodeAttrProbeUDPLifetime,
 
 	// [tailcfg.NodeAttrSSHBehaviorV1]: configures the embedded SSH