Just as @wout.peeters said, try using MSI instead of a win32 deployment package. I find this also less work than preparing win32 app packages, but you loose “supersede” functionality, and as a result, test-deployments for a subset of your devices are slightly more opaque.
So, strong recommendation: Try MSI, but also try updating that MSI via endpoint and see if the machines can reconnect reliably after that (why? because, for us it doesn’t work, so we … update less).
ETA: Maybe also have a look at Unattended Tailscale Doesn't Survive Reboot - discussion about unattended install for Windows