ipn/ipnlocal: move last unconditional gvisor import, complete ts_omit_netstack support

Fixes #17283

Change-Id: Ia84d269683e4a68d7d10562561204934eeaf53bb
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

cmd/tailscaled/deps_test.go

@@ -186,6 +186,19 @@ func TestOmitDBus(t *testing.T) {
 	}.Check(t)
 }
 
+func TestNetstack(t *testing.T) {
+	deptest.DepChecker{
+		GOOS:   "linux",
+		GOARCH: "amd64",
+		Tags:   "ts_omit_gro,ts_omit_netstack,ts_omit_outboundproxy,ts_omit_serve,ts_omit_ssh,ts_omit_webclient,ts_omit_tap",
+		OnDep: func(dep string) {
+			if strings.Contains(dep, "gvisor") {
+				t.Errorf("unexpected gvisor dep: %q", dep)
+			}
+		},
+	}.Check(t)
+}
+
 func TestOmitPortlist(t *testing.T) {
 	deptest.DepChecker{
 		GOOS:   "linux",