fix(deps): siderolabs talos and machinery pins can skew, breaking the build

> 🤖 Generated by the Agentic Engineer

## Evidence

`github.com/siderolabs/talos` and `github.com/siderolabs/talos/pkg/machinery` are released together and
share the `config` API, but ksail pins them independently. On `main` both sit at `v1.14.0-alpha.2`.

Any bump that raises `machinery` alone breaks the build. Observed on #6724, where an `omni/client`
1.9.1 → 1.10.4 bump transitively raised `machinery` to `v1.14.0-beta.1` and left `talos` at alpha.2:

```
pkg/fsutil/configmanager/talos/configs.go:615:54:
cp.Machine().Kubelet undefined (MachineConfig has no field or method Kubelet)
pkg/fsutil/configmanager/talos/version.go:223:28: machineCfg.Kubelet undefined

.../talos@v1.14.0-alpha.2/pkg/images/list.go:43:49:
config.Cluster().CoreDNS undefined (ClusterConfig has no field or method CoreDNS)
```

The last line is pinned **Talos alpha.2 source failing against beta.1 machinery** — proof the breakage is
the skew itself, not our call sites alone.

## Why this recurs rather than being a one-off

`machinery` is an *indirect* dependency, so MVS treats it as a floor: any dependent that requires a newer
machinery raises it silently, with no corresponding change to the direct `talos` pin. Dependabot cannot
perform the coordinated two-module upgrade, so every such bump arrives red and unmergeable. #6724 is the
current instance; it will keep happening.

## Expected behaviour

The two siderolabs modules move together, and a transitive raise of one cannot silently skew them.

## Acceptance criteria

- [ ] `siderolabs/talos` and `siderolabs/talos/pkg/machinery` are on the same version.
- [ ] Call sites adapted to the target `config` API — at minimum `MachineConfig.Kubelet`
(`pkg/fsutil/configmanager/talos/configs.go`, `version.go`) and `ClusterConfig.CoreDNS`.
- [ ] The Talos CI legs pass.
- [ ] A guard prevents the silent skew recurring — e.g. a `replace` keeping machinery pinned to the
direct `talos` version, or a check asserting the two versions match. Choose one and state why.
- [ ] #6724 rebased or closed as superseded once this lands.

Size: medium. The upgrade itself is small; the API migration and the anti-recurrence guard are the work.

Start by inspecting the direct talos and machinery pins and the affected API usage in pkg/fsutil/configmanager/talos/configs.go and version.go. Check the Talos CI legs while adapting the listed config APIs, then verify both module versions match and add one guard against future skew. Confirm that #6724 is rebased or closed as superseded.

Written by the indexing model from the issue text.