Regression in rpm package in 1.98.9 for AlmaLinux. RPM package dropped kernel-modules-extra dependency, causing xt_mark module missing on fresh installs

### What is the issue?

(This report was written by my agent, but maybe the real cause is just a rare edge case where if the kernel is updated at the same time tailscale is installed, kernel-modules-extra slips through the cracks? The core issue was that kernel-modules-extra was not installed as a dependency.)

## Summary

The Tailscale RPM for RHEL/AlmaLinux 10 previously pulled in `kernel-modules-extra` as a dependency during installation. The current RPM no longer requires it, causing `xt_mark` to be missing on fresh installs. This results in the health check error:

```
# Health check:
# - adding [-i tailscale0 -j MARK --set-mark 0x40000/0xff0000] in v4/filter/ts-forward: running [/usr/sbin/iptables -t filter -A ts-forward -i tailscale0 -j MARK --set-mark 0x40000/0xff0000 --wait]: exit status 2: Warning: Extension MARK revision 0 not supported, missing kernel module?
iptables v1.8.11 (nf_tables): MARK: bad value for option "--set-mark", or out of range (0-4294967295).
```

## Evidence

Two identical AlmaLinux 10 boxes, same clone source, same kernel (`6.12.0-211.34.1.el10_2.x86_64`). Tailscale installed one week apart.

**Box A (installed ~July 9, tailscale 1.98.8):**

```
$ sudo dnf history info 3
Transaction ID : 3
Command Line : install -y tailscale
Packages Altered:
Install iptables-nft-1.8.11-13.el10_1.x86_64 @appstream
Install kernel-modules-extra-6.12.0-211.31.1.el10_2.x86_64 @baseos
Install libnftnl-1.3.0-3.el10.x86_64 @baseos
Install tailscale-1.98.8-1.x86_64 @tailscale-stable
```

`kernel-modules-extra` was installed as a dependency. Module present:

```
$ find /lib/modules/$(uname -r) -name 'xt_mark*'
/lib/modules/6.12.0-211.34.1.el10_2.x86_64/kernel/net/netfilter/xt_mark.ko.xz
```

**Box B (installed ~July 16, current tailscale):**

```
$ sudo dnf history info 7
Transaction ID : 7
Begin time : Thu 16 Jul 2026 07:09:23 PM UTC
Begin rpmdb : f4c6dc3e6b28d10e6a054174c36a3c1dc22246bdecb1e3399cc5408d97d64673
End time : Thu 16 Jul 2026 07:10:16 PM UTC (53 seconds)
End rpmdb : 52392b6c5063b0386beeebbc4949c5744ec61026881ee8a312da2fe0cd762584
User : Cloud User
Return-Code : Success
Releasever : 10
Command Line : install -y tailscale
Persistence : Persist
Comment :
Packages Altered:
Install iptables-nft-1.8.11-15.el10_2.x86_64 @appstream
Install kernel-debug-core-6.12.0-211.34.1.el10_2.x86_64 @baseos
Install kernel-debug-modules-6.12.0-211.34.1.el10_2.x86_64 @baseos
Install kernel-debug-modules-core-6.12.0-211.34.1.el10_2.x86_64 @baseos
Install kernel-debug-modules-extra-6.12.0-211.34.1.el10_2.x86_64 @baseos
Install libnftnl-1.3.0-3.el10.x86_64 @baseos
Install tailscale-1.98.9-1.x86_64 @tailscale-stable
Scriptlet output:
1 Generating grub configuration file ...
2 Adding boot menu entry for UEFI Firmware Settings ...
3 done
```

`kernel-modules-extra` was not installed. Module missing:

```
$ find /lib/modules/$(uname -r) -name 'xt_mark*'
[no output]

$ sudo modprobe xt_mark
modprobe: FATAL: Module xt_mark not found in directory /lib/modules/6.12.0-211.34.1.el10_2.x86_64
```

## Root cause

On RHEL 10 / AlmaLinux 10, `xt_mark.ko` ships in the `kernel-modules-extra` subpackage, not in `kernel-modules` or `kernel-core`. The previous Tailscale RPM required `kernel-modules-extra` (directly or transitively), so it was installed automatically. The current RPM does not.

Tailscale's code attempts to `modprobe xt_mark` at runtime (per #4329), but this only works if the module is already on disk — which requires the package to be installed.

## Workaround

```bash
sudo dnf install kernel-modules-extra
sudo depmod -a
sudo modprobe xt_mark
sudo systemctl restart tailscaled
```

## Suggested fix

Add `Requires: kernel-modules-extra` to the RPM spec for RHEL-family distributions, or document `kernel-modules-extra` as a required prerequisite for exit node / subnet routing functionality on RHEL 10+.

## Environment

- OS: AlmaLinux 10.2
- Kernel: 6.12.0-211.34.1.el10_2.x86_64
- Tailscale (working): 1.98.8-1
- Tailscale (broken): current stable as of July 16, 2026

### Steps to reproduce

Install tailscale 1.98.9 rpm from the official repo using the curl one-liner. Observe that the module is not present.

### Are there any recent changes that introduced the issue?

The update to 1.98.9

### OS

Linux

### OS version

AlmaLinux 6.12.0-211.34.1.el10_2.x86_64

### Tailscale version

1.98.9

### Other software

_No response_

### Bug report

_No response_

Start by locating the RPM spec and packaging rules for RHEL-family distributions, then compare the dependency emitted for 1.98.8 and 1.98.9. Reproduce the issue on AlmaLinux 10 with a fresh 1.98.9 install and verify that kernel-modules-extra and xt_mark are present and the health check succeeds.

Written by the indexing model from the issue text.