#23669: refactor(logging): migrate node-host and tailscale console calls to subsystem logger

## Summary - Problem: `src/node-host/runner.ts` and `src/infra/tailscale.ts` use raw `console.log`/`console.error` calls that bypass structured logging, leak PATH env info, and can't be filtered by log level - Why it matters: Raw console output in production code bypasses log level controls and may expose sensitive environment details (full PATH variable) - What changed: Migrated remaining console calls to `createSubsystemLogger()` in node-host runner and tailscale modules, continuing the migration started in PRs #22964 and #22906 - What did NOT change: User-facing CLI output via `runtime.error()` calls is preserved unchanged ## Change Type - [x] Refactor ## Scope - [x] Gateway / orchestration ## Security Impact - New permissions/capabilities? No - Secrets/tokens handling changed? No - New/changed network calls? No - Command/tool execution surface changed? No - Data access scope changed? No ## Compatibility / Migration - Backward compatible? Yes - Config/env changes? No - Migration needed? No ## Risks and Mitigations - Risk: Some debug output may no longer appear at default log level - Mitigation: This is intentional — PATH info should be behind verbose/debug level 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- greptile_comment --> <h3>Greptile Summary</h3> Migrates the last remaining raw `console.log`/`console.error` calls in `src/node-host/runner.ts` and `src/infra/tailscale.ts` to the structured `createSubsystemLogger()` system, continuing the pattern established in PRs #22964 and #22906. - **`src/node-host/runner.ts`**: Three `console.log`/`console.error` calls (with `eslint-disable` comments) replaced with `log.info()` and `log.warn()` calls via a `"node-host"` subsystem logger. PATH info is now structured metadata instead of a raw string, and connection error/close messages use `warn` level. - **`src/infra/tailscale.ts`**: One `console.log` replaced with `log.info()` via a `"tailscale"` subsystem logger. Four `console.error` calls in the error path of `ensureFunnel` correctly migrated to `runtime.error()` (user-facing CLI output), preserving the existing `runtime` parameter available in that function's signature. - Both files now have zero raw `console` calls, and all new patterns are consistent with the established subsystem logger usage across the codebase. <h3>Confidence Score: 5/5</h3> - This PR is safe to merge — it's a straightforward mechanical refactor with no behavioral changes to user-facing output. - Score of 5 reflects: (1) minimal, mechanical changes replacing raw console calls with established subsystem logger patterns, (2) consistent with existing codebase conventions, (3) user-facing CLI output via `runtime.error()` is preserved unchanged, (4) no remaining raw console calls in either file, (5) existing tests for `ensureFunnel` use mocked `runtime` objects that will work correctly with the new `runtime.error()` calls. - No files require special attention. _{Last reviewed commit: 7b16206} <!-- greptile_other_comments_section --> _{(5/5) You can turn off certain types of comments like style [here](https://app.greptile.com/review/github)!} <!-- /greptile_comment -->