[BUG] Cowork VM boots but API unreachable on Windows - HNS NAT missing WinNAT rule

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Cowork consistently fails with "Can't reach the Claude API from Claude's workspace." The VM boots and gets network connectivity but cannot reach api.anthropic.com.
Environment:

Claude Desktop (latest)
Windows 11
Hyper-V enabled
VMware Workstation installed
UniFi UCG Ultra network
ExpressVPN previously installed (now uninstalled)

What happens:
The CoworkVMService creates an HNS NAT network (cowork-vm-nat, subnet 172.16.0.0/24 or 172.17.0.0/24) but does NOT create a corresponding WinNAT rule. Get-NetNat returns empty. Without the WinNAT rule, the VM has no route to the internet.
Manually running New-NetNat fails with Windows System Error 52 (duplicate name) even though Get-NetNat is empty — the HNS network's internal NAT registration blocks it.
Steps to reproduce:

Install Claude Desktop on Windows 11 with Hyper-V + VMware
Open Cowork tab
Observe: VM boots, network shows CONNECTED, then API reachability goes UNREACHABLE
Run Get-NetNat → empty
Run New-NetNat -Name "cowork-vm-nat" -InternalIPInterfaceAddressPrefix "172.16.0.0/24" → Error 52

Related issues: #25308, #25155, #24918

What Should Happen?

Cowork workspace should start successfully and connect to the Claude API, the same way regular Chat mode works without issues.

Error Messages/Logs

PS C:\WINDOWS\system32> Get-NetNat
PS C:\WINDOWS\system32> 

PS C:\WINDOWS\system32> New-NetNat -Name "cowork-vm-nat" -InternalIPInterfaceAddressPrefix "172.16.0.0/24"
New-NetNat : You were not connected because a duplicate name exists on the network...
FullyQualifiedErrorId : Windows System Error 52,New-NetNat

Steps to Reproduce

1. Install Claude Desktop (latest) on Windows 11 with Hyper-V enabled and VMware Workstation installed
2. Open the Cowork tab
3. VM downloads and boots successfully
4. Network status shows CONNECTED
5. API reachability goes PROBABLY_UNREACHABLE → UNREACHABLE
6. Error: "Failed to start Claude's workspace - Can't reach the Claude API"
7. Run Get-NetNat in admin PowerShell → returns empty (no WinNAT rule created)
8. Attempt New-NetNat manually → fails with Windows System Error 52

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.45 (Claude Code)

Platform

Claude.ai

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_