Disabled update checks prevent security patch awareness

When CheckUpdates policy is set to 'never' on Windows or SUEnableAutomaticChecks is set to false on macOS, the client stops checking for updates. This prevents users from being notified about available security updates in a timely manner.

Review the CheckUpdates (Windows) and SUEnableAutomaticChecks (macOS) policies. The documentation recommends leaving update checks enabled to ensure timely security updates. If manual deployment is required, establish a process to monitor Tailscale security advisories and deploy updates promptly. Consider enabling InstallUpdates/SUAutomaticallyUpdate to automate security patching.