Upgrading to 1.94.4 stops DNS working in fly.io machine. resolv.conf not updated and health check error in tailscale status

### What is the issue?

I have tailscale running in a number of my fly apps. I did a deployment of an app yesterday and it pulled the latest version of tailscale 1.94.4. Dns did not function.

If I ssh to the machine I can ping tailscale IP addresses just fine, but dns resolution for short names or fqdns doesnt work. The resolve.conf in the machine doesnt contain the tailscale server just the default fly one.

If you run tailscale status you get this error at the bottom.

```
# Health check:
# - enabling connmark rules: adding [-m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark --nfmask 0xff0000 --ctmask 0xff0000] in mangle/PREROUTING: running [/usr/sbin/iptables -t mangle -I PREROUTING 1 -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark --nfmask 0xff0000 --ctmask 0xff0000 --wait]: exit status 2: Warning: Extension CONNMARK revision 0 not supported, missing kernel module?
iptables v1.8.9 (nf_tables): unknown option "--nfmask"
Try `iptables -h' or 'iptables --help' for more information.
```

If I downgrade it to 1.94.2 it all goes back to working again.

### Steps to reproduce

Install tailscale inside a fly.io machine

force downgrade to 1.94.2 and it works again.

### Are there any recent changes that introduced the issue?

_No response_

### OS

_No response_

### OS version

_No response_

### Tailscale version

_No response_

### Other software

_No response_

### Bug report

_No response_