It starts with DisableNetwork set to 1, so it's OK.

Additionally, ensure /etc/resolv-over-clearnet.conf always exists: without this,
we would start tor@default.service before NM connects to a network, and thus
/etc/resolv-over-clearnet.conf has not been created by
/etc/NetworkManager/dispatcher.d/00-resolv-over-clearnet yet, and then
tor@default.service fails to start because
BindReadOnlyPaths=/etc/resolv-over-clearnet.conf:/etc/resolv.conf fails.

refs #18448