Fix macOS Hack DNS target

[paulkarcher]

Summary

• keep the stable macOS host DNS target on the reserved Caddy bridge IP when the host can actually reach it
• fall back to 127.0.0.1 only when the host cannot route to 172.30.0.2:443
• align hack doctor --fix and the install guidance with the same reachability-based decision
• document the bridge-IP-first model and the localhost fallback behavior

Root cause

Hack intentionally uses the fixed hack-dev ingress addresses so host DNS can bypass flaky localhost port-forwarding paths and resolve directly to global ingress. That works on many setups, but some macOS environments cannot route host traffic to the Docker bridge address 172.30.0.2, so requests to https://*.hack hang even though Caddy is healthy.

The fix here is not to globally revert macOS back to localhost. Instead, hack global install and the doctor repair path now probe the environment and choose the host DNS target that is actually reachable on that machine.

Behavior

• if 172.30.0.2:443 is reachable from the host, macOS dnsmasq keeps pointing *.hack and *.hack.gy at 172.30.0.2
• if the bridge IP is not reachable but localhost is, macOS dnsmasq points those domains at 127.0.0.1
• existing working bridge-IP installs stay on the stable reserved address instead of being migrated unnecessarily
• broken installs can repair themselves to the localhost fallback via hack global install or hack doctor --fix

Validation

• bun test tests/doctor-utils.test.ts tests/coredns-config.test.ts tests/global-command.test.ts tests/global-command.macos.test.ts
• bun run --cwd packages/cli test
• manual verification on a machine where 172.30.0.2:443 is reachable from the host still keeps .hack resolving to 172.30.0.2

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6e0336b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR