Migrate off the removed Talos MachineConfig.Kubelet / ClusterConfig.CoreDNS accessors

> 🤖 Generated by the Agentic Engineer

## Evidence

`chore(deps): bump github.com/siderolabs/omni/client from 1.9.1 to 1.10.4` (#6724) has been red and conflicting since 2026-08-27. It is not a flaky or transient failure — the bump is structurally unmergeable as it stands.

`go.mod` on `main` holds both Talos modules at the same version:

```
github.com/siderolabs/talos v1.14.0-alpha.2
github.com/siderolabs/talos/pkg/machinery v1.14.0-alpha.2
```

`omni/client v1.10.4` requires `github.com/siderolabs/talos/pkg/machinery v1.14.0-beta.1` (read from its published `go.mod` on the module proxy), so the bump raises `machinery` alone and leaves the pair mismatched. `beta.1` removed accessors that both KSail and `talos v1.14.0-alpha.2` still call:

```
pkg/fsutil/configmanager/talos/configs.go:615 cp.Machine().Kubelet undefined
pkg/fsutil/configmanager/talos/configs.go:619 cp.Machine().Kubelet undefined
pkg/fsutil/configmanager/talos/version.go:223 machineCfg.Kubelet undefined
talos@v1.14.0-alpha.2/pkg/images/list.go:43 config.Cluster().CoreDNS undefined
talos@v1.14.0-alpha.2/pkg/images/list.go:45 config.Machine().Kubelet undefined
```

The last two are inside the pinned `talos` module itself, so the dependency graph is internally inconsistent — this cannot be fixed in KSail's code alone while `talos` stays at `alpha.2`.

Confirmed against `machinery v1.14.0-rc.2`: `config.MachineConfig` no longer declares `Kubelet()`, and CoreDNS survives only as `K8sCoreDNSConfig` in `config/config/k8s.go`. Upstream moved kubelet and CoreDNS settings out of the machine/cluster config into a separate K8s config document.

## Problem and who it affects

Every `omni/client` bump is blocked behind this, so KSail silently stops receiving Omni updates — including security fixes. Renovate/Dependabot will keep reopening the bump and it will keep failing, which also burns CI on every attempt.

## What needs to happen

Bump `github.com/siderolabs/talos` and `github.com/siderolabs/talos/pkg/machinery` together to a matched version (`v1.14.0-rc.2` is the newest published pair), then migrate KSail's three call sites off the removed accessors onto the new K8s config document API.

## Acceptance criteria

- [ ] Both Talos modules pinned to the same version in `go.mod`.
- [ ] The three call sites above read kubelet/CoreDNS settings through the new document API.
- [ ] The absent-document case is handled explicitly — a config with no K8s document must not silently read as "no kubelet configured" (this is the fail-open shape, not a nil check to wave through).
- [ ] Existing tests pass **unmodified**; behaviour is preserved.
- [ ] #6724 (or its successor bump) goes green and merges.

## Size

Medium. Three call sites, but the new accessor pattern and the absent-document semantics need to be understood first, so it is not a mechanical rename.

**Blocker:** loft-sh/apiserver — needs a revision built against Kubernetes 0.37 apiserver | last-verified 2026-09-05: not shipped. A newer revision HAS been published since the previous record — `@latest` now resolves to v0.0.0-20260903125814-2353e4b52582 (2026-09-03), superseding v0.0.0-20260707184419-aef558a5ae8d (2026-07-07) — but it does NOT clear this blocker: its own go.mod still requires `k8s.io/apiserver v0.36.0`, so the 0.37 compatibility predicate remains unsatisfied. Re-verified 2026-09-05 via the Go module proxy (`@latest` plus the published `.mod`); the module path was resolved from ksail's own go.mod, not from this issue. Note its go.mod also carries `replace k8s.io/apiserver => github.com/loft-sh/k8s-apiserver v0.36.0-loft.0` — a replace in a dependency's go.mod is ignored by consumers, so that fork does not reach ksail and cannot be relied on to satisfy the bump. `k8s.io/cri-client` remains stable at v0.37.0 (2026-08-26), so that half of the bump still needs no release candidate.

Start with go.mod and the three call sites in pkg/fsutil/configmanager/talos/configs.go and version.go, then read Talos's new K8s config document API and its handling of absent documents. Verify the matched module versions and preserve the existing behavior, including explicit absent-document handling; existing tests should remain unmodified and the Omni bump should pass.

Written by the indexing model from the issue text.