fix: pin headscale image to v0.29.0 and drop removed config keys

新版 headscale 移除了部分設定鍵，搭配 watchtower 自動更新 :latest
導致容器啟動即 FATAL、無限重啟，所有節點離線。

- config.yaml: 註解 randomize_client_port（FATAL）與 ephemeral_node_inactivity_timeout（已改名）
- docker-compose.yml: image 釘到 v0.29.0，停止破壞性自動升級
- OPERATIONS.md / CLAUDE.md: 補上故障排除與升級注意事項

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -91,6 +91,7 @@ The `config.yaml` file contains:
 - External Docker network (`shared-net`) for connectivity
 - Three critical ports: 8080 (HTTP API), 9090 (metrics), 50443 (gRPC)
 - Watchtower integration for automatic image updates
+  > ⚠️ Because the image is pinned to `:latest` **and** auto-updated by Watchtower, a breaking change in a new Headscale release can crash-loop the container (a removed config key triggers a startup FATAL, taking every node offline). Removed keys seen so far: `randomize_client_port` (FATAL), `ephemeral_node_inactivity_timeout` (renamed to `node.ephemeral.inactivity_timeout`). Prefer pinning a specific version tag, or review the CHANGELOG BREAKING section before upgrading. See OPERATIONS.md → 故障排除.
 
 ### Security Model
 - Bearer token authentication for API access (hardcoded in scripts)