Lima CI with almalinux-10 always fails

### Description

I tried to add AlmaLinux-10 to the Lima CI matrix in the same way as https://github.com/lima-vm/lima/pull/5350, but it consistently fails (although the same approach works just fine with AlmaLinux-9).

Here is an example run: https://github.com/whoschek/lima/actions/runs/30305767370/job/90109551500

Lima’s boot runner records failures in CODE, but writes /run/lima-boot-done before exiting nonzero in [boot.sh (line 243)].
The host agent sees that marker and declares the instance ready. Meanwhile, cloud-init records cloud-final.service as failed.
The integration test later runs:

```systemctl is-system-running --wait```

in test-templates.sh (line 327), sees degraded, and stops. It never reaches the container-engine tests.

There are two independent product issues
- The mDNS script incorrectly assumes that having resolvectl means systemd-resolved.service exists.
AlmaLinux 10 has the command but not the service unit. The restart fails in 06-enable-mdns-on-systemd.sh (line 15), contributing to the failed cloud-final.service.
- The image lacks supplemental Netfilter modules.
Lima installs iptables-nft but not kernel-modules-extra-$(uname -r) in 30-install-packages.sh (line 78).
This causes:
- Lima host-DNS rule installation to fail.
- Rootless BuildKit’s CNI setup to fail on xt_comment.
- The containerd installation boot script to report failure.

Looks like two changes are needed:

- In the mDNS script, skip configuration unless the actual service unit exists—for example, guard with systemctl cat systemd-resolved.service. Don't install or activate systemd-resolved on AlmaLinux merely for this script.

- In DNF dependency resolution, when Lima requires iptables and required modules such as iptable_nat or xt_comment are unavailable:
- Install the available exact-version package kernel-modules-extra-$(uname -r).
- Rerun Lima’s module-loading script after installation.
- Keep this capability-based so distributions without that package remain unaffected.

Start with 06-enable-mdns-on-systemd.sh and 30-install-packages.sh, then inspect boot.sh and test-templates.sh around the referenced lines. Reproduce the AlmaLinux-10 CI failure and verify that mDNS is skipped without its service unit, required kernel modules are available when supported, and the integration test reaches the container-engine tests.

Written by the indexing model from the issue text.