Talos machinery moved kubelet config off MachineConfig, blocking every talos group bump

> 🤖 Generated by the Agentic Engineer

## Evidence

Talos machinery moved kubelet configuration out of the `machine:` section between `v1.14.0-alpha.2` (what `main` pins) and `v1.14.0-rc.2`, and `ksail` still reads it from the old place. Every dependency PR that carries machinery past alpha.2 therefore fails to compile:

- **#6826** (`chore(deps): bump the talos group`, tagged `v1.14.0-rc.2`) — `🏗️ Build` fails at head `634c83a3`
- **#6845** (`image-factory 1.3.3 → 1.5.1`, which drags machinery to a post-rc.2 pseudo-version) — same three errors

```
pkg/fsutil/configmanager/talos/configs.go:615:54: cp.Machine().Kubelet undefined
pkg/fsutil/configmanager/talos/configs.go:619:28: cp.Machine().Kubelet undefined
pkg/fsutil/configmanager/talos/version.go:244:28: machineCfg.Kubelet undefined
```

Diffing the two `config/config/machine.go` interfaces from the module cache shows this is not a rename but a relocation, and that **eight** methods left `MachineConfig` in that window — `Controlplane`, `Pods`, `Kubelet`, `Kernel`, `NodeLabels`, `NodeAnnotations`, `NodeTaints`, `BaseRuntimeSpecOverrides`. The build only ever reports `Kubelet` because compilation stops at the first failure, so the error list understates the change.

Kubelet config now hangs off the **root** config rather than the machine section: `Config.K8sKubeletConfig() K8sKubeletConfig` (`config/config/config.go:61`).

## Why this matters

It is the sole ksail-side blocker on the whole Talos dependency group. It is distinct from #6728, which is the k8s-version conflict (`loft-sh/apiserver`, `cri-client`) — that one also fires on #6826, but the two are independent and #6728 does not cover this.

## Scope — small, and confirmed small

`main` uses only `Kubelet()`, and only for `.Image()` and `.ExtraArgs()`, both of which the new `K8sKubeletConfig` still has. None of the other seven removed methods is referenced. So the migration is:

| site | change |
|---|---|
| `configs.go:615,619` | `cp.Machine().Kubelet()` → `cp.K8sKubeletConfig()` |
| `version.go:244` | `machineCfg.Kubelet()` → the same root accessor; needs the root config in scope rather than the `MachineConfig` it currently holds |
| `configs.go:37` | doc comment naming the old path |

Two accessors dropped that ksail does not use (`CredentialProviderConfig`, `RegisterWithFQDN`, `NodeIP`, `SkipNodeRegistration`); nothing to port.

## Acceptance criteria

- `configs.go` and `version.go` read kubelet config through `K8sKubeletConfig()`, with the doc comment updated.
- `IsKubeletCertRotationEnabled` keeps its current behaviour — a test pins it across the migration, since its nil-guard shape changes when the accessor moves off `Machine()`.
- The talos group bump (#6826) compiles. It will still be red on #6728's k8s conflict; that is expected and out of scope here.

Rough size: small, ~3 call sites plus a test.

Start in pkg/fsutil/configmanager/talos/configs.go and version.go, then inspect the Talos config interfaces named in the issue. Update the three kubelet access sites and the comment, and add or adjust the test covering IsKubeletCertRotationEnabled across the accessor migration. Run the relevant tests and verify the Talos group bump compiles, while the separate Kubernetes conflict remains out of scope.

Written by the indexing model from the issue text.