Adding connmark rules fails with 1.96.4 on Nvidia L4T 36.4.4

### What is the issue?

With 1.96.4 on Nvidia L4T 36.4.4 (Ubuntu Jammy) on a Jetson AGX Orin, `tailscale status` shows this error at the bottom:

```
# Health check:
# - enabling connmark rules: adding [-m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark --nfmask 0xff0000 --ctmask 0xff0000] in mangle/PREROUTING: running [/usr/sbin/iptables -t mangle -I PREROUTING 1 -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark --nfmask 0xff0000 --ctmask 0xff0000 --wait]: exit status 2: iptables v1.8.7 (legacy): unknown option "--restore-mark"
Try `iptables -h' or 'iptables --help' for more information.
```

If I downgrade to 1.94.2, the health check succeeds. #19354 might be related.

### Steps to reproduce

Install tailscale 1.96.4 on clean install of L4T 36.4.4.

Run `tailscale status`, conntrack error is displayed.

### Are there any recent changes that introduced the issue?

_No response_

### OS

Linux

### OS version

L4T 36.4.4

### Tailscale version

1.96.4

### Other software

_No response_

### Bug report

BUG-cf31dfe30058f36253175eda6a7ff48eb73f4b867666d21477bb530d6a3a45a0-20260414003025Z-65f656ea8f282919

Reproduce the failure on Nvidia L4T 36.4.4 with Tailscale 1.96.4 and run `tailscale status`; compare the result with version 1.94.2. Trace the connmark-rule setup and the iptables command shown in the health check. Done means connmark rules enable without the health-check error on the reported platform.

Written by the indexing model from the issue text.