Bundled binfmt QEMU 7.0.0 lacks `openat2()` — amd64 emulation fails

### Description

Bundled binfmt QEMU 7.0.0 lacks `openat2()` — amd64 emulation fails with "Function not implemented" on recent guest userlands (e.g. Ubuntu 26.04 tar)

The QEMU user-mode emulators that Colima registers in the VM for foreign-arch
emulation are pinned to **QEMU 7.0.0** (built 2022-08-02) via
`BINFMT_VERSION="deploy/v7.0.0-28"` in
[colima-core `dependencies.env`](https://github.com/abiosoft/colima-core/blob/main/dependencies.env).

QEMU's linux-user emulator only gained support for the `openat2()` syscall with
commit [`9651cead2f1b`](https://github.com/qemu/qemu/commit/9651cead2f1b)
(2024-10-01), first shipped in QEMU 9.2 — so the bundled 7.0.0 returns `ENOSYS`
for it. Recent distro userlands have started using `openat2()` — notably GNU tar
in Ubuntu 26.04 "Resolute", which opens directories with
`openat2(..., RESOLVE_BENEATH)` during extraction (visible with `QEMU_STRACE=1`)
— so **any `tar` extraction inside an emulated linux/amd64 container or image
build on an aarch64 host fails**:

```
tar: src/f: Cannot open: Function not implemented
tar: Exiting with failure status due to previous errors
```

In practice this breaks e.g. multi-arch `docker buildx` builds of
Ubuntu-resolute-based images on Apple Silicon: any build step that untars
something (source tarballs via cpanm/pip/npm, `ADD` of archives, etc.) dies
with ENOSYS.

Note this makes emulation of such images completely unavailable on Apple
Silicon: the default vz+Rosetta path fails on the same missing syscall (a
Rosetta limitation outside Colima's control), and the QEMU fallback — which
upstream QEMU has already fixed — is defeated by the 2022 pin.

### Version

## Version

```
colima version 0.10.3
git commit: 00f6c297e92a82c04a4ab507db0a61435650d7e8

runtime: docker
arch: aarch64
client: v29.7.0
server: v29.7.0
limactl version 2.2.0
qemu-img version 11.0.3
```

## OS

macOS Apple Silicon >= 14 (macOS 26.5.2)

### Operating System

- [ ] macOS Intel <= 13 (Ventura)
- [ ] macOS Intel >= 14 (Sonoma)
- [ ] Apple Silicon <= 13 (Ventura)
- [x] Apple Silicon >= 14 (Sonoma)
- [ ] Linux

### Output of `colima status`

## Output of `colima status`

```
INFO[0000] colima [profile=qemu] is running using QEMU
INFO[0000] arch: aarch64
INFO[0000] runtime: docker
INFO[0000] mountType: sshfs
INFO[0000] docker socket: unix:///Users//.colima/qemu/docker.sock
```

### Reproduction Steps

## Reproduction Steps

1. On an Apple Silicon Mac, start a profile that uses the bundled QEMU binfmt
emulators (i.e. Rosetta not active):

```sh
colima start -p qemu --vm-type qemu
```

2. Run a trivial tar round-trip in an emulated amd64 container with a recent
userland:

```sh
docker --context colima-qemu run --rm --platform linux/amd64 ubuntu:resolute \
sh -c 'cd /tmp && mkdir src && echo hi > src/f && tar cf t.tar src && mkdir out && tar xf t.tar -C out && echo EXTRACT-OK'
```

3. Observe:

```
tar: src/f: Cannot open: Function not implemented
tar: Exiting with failure status due to previous errors
```

The same happens inside `docker buildx` builds (docker-container driver)
for `--platform linux/amd64`.

### Expected behaviour

## Expected behaviour

`EXTRACT-OK` — tar extraction under amd64 emulation succeeds.

It does succeed after replacing the registered handler with a current QEMU:

```sh
docker --context colima-qemu run --privileged --rm tonistiigi/binfmt --uninstall qemu-x86_64
docker --context colima-qemu run --privileged --rm tonistiigi/binfmt --install amd64
# repro command above now prints EXTRACT-OK
```

(Not persistent — binfmt_misc registrations reset on every VM restart, so this
has to be re-applied after each `colima restart`.)

### Additional context

## Additional context

- The emulator inside the VM is not from the guest distro (Ubuntu 24.04 ships
QEMU 8.2): `/usr/bin/qemu-x86_64` is owned by no dpkg package, dated
2022-08-02, and reports `qemu-x86_64 version 7.0.0 (v7.0.0)`. It comes from
the `BINFMT_VERSION="deploy/v7.0.0-28"` / `BINFMT_QEMU_VERSION="7.0.0"` pin in
[colima-core `dependencies.env`](https://github.com/abiosoft/colima-core/blob/main/dependencies.env),
downloaded from `tonistiigi/binfmt` releases by
[`scripts/binfmt.sh`](https://github.com/abiosoft/colima-core/blob/main/scripts/binfmt.sh).
- `tonistiigi/binfmt` currently publishes
[`deploy/v10.2.3-68`](https://github.com/tonistiigi/binfmt/releases) (QEMU
10.2.3, June 2026). Bumping the pin to any release with QEMU >= 9.2 fixes
this; I'm happy to send a PR to colima-core for that.
- Expect this class of failure to become more common as more distro tools
(coreutils, tar, container runtimes) adopt `openat2()`.