Lima CI with almalinux-10 always fails #5368

Description

I tried to add AlmaLinux-10 to the Lima CI matrix in the same way as #5350, but it consistently fails (although the same approach works just fine with AlmaLinux-9).

Here is an example run: https://github.com/whoschek/lima/actions/runs/30305767370/job/90109551500

Lima’s boot runner records failures in CODE, but writes /run/lima-boot-done before exiting nonzero in [boot.sh (line 243)].
The host agent sees that marker and declares the instance ready. Meanwhile, cloud-init records cloud-final.service as failed.
The integration test later runs:

systemctl is-system-running --wait

in test-templates.sh (line 327), sees degraded, and stops. It never reaches the container-engine tests.

There are two independent product issues

• The mDNS script incorrectly assumes that having resolvectl means systemd-resolved.service exists.
  AlmaLinux 10 has the command but not the service unit. The restart fails in 06-enable-mdns-on-systemd.sh (line 15), contributing to the failed cloud-final.service.
• The image lacks supplemental Netfilter modules.
  Lima installs iptables-nft but not kernel-modules-extra-$(uname -r) in 30-install-packages.sh (line 78).
  This causes:
  • Lima host-DNS rule installation to fail.
  • Rootless BuildKit’s CNI setup to fail on xt_comment.
  • The containerd installation boot script to report failure.

Looks like two changes are needed:

• In the mDNS script, skip configuration unless the actual service unit exists—for example, guard with systemctl cat systemd-resolved.service. Don't install or activate systemd-resolved on AlmaLinux merely for this script.

• In DNF dependency resolution, when Lima requires iptables and required modules such as iptable_nat or xt_comment are unavailable:

  • Install the available exact-version package kernel-modules-extra-$(uname -r).
  • Rerun Lima’s module-loading script after installation.
  • Keep this capability-based so distributions without that package remain unaffected.