Function tailnet_sans_from_status 

pub fn tailnet_sans_from_status(
    status: Result<TailscaleSelf>,
    hostname_override: Option<String>,
) -> TailnetSans

Classify a tailscale status outcome. Only a usable identity (TailscaleSelf::has_identity) is Resolved. A failed or timed-out query, malformed output, and a successful status reported before tailscaled has its network map are all Unavailable, so the existing certificate keeps its names instead of being regenerated without them.