kernel: enable cgroup controllers and pod networking for k3s

CONFIG_CPUSETS was a k3s fatal; add the rest of the cgroup2 controller
set, runc needs (keys, seccomp, cgroup bpf), veth/vxlan/bridge-netfilter
and the xt matches kube-proxy programs, plus NFT_COMPAT so iptables-nft
userland works. All built-in; the kernel stays module-free.

Co-authored-by: Hanzo Dev <[email protected]>

kernel/vm_defconfig

@@ -190,3 +190,43 @@ CONFIG_RTC_DRV_PL031=y
 # CONFIG_MEDIA_SUPPORT is not set
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_MD is not set
+
+# Cgroup v2 controllers k3s requires (cpuset is fatal when missing)
+CONFIG_CPUSETS=y
+CONFIG_PROC_PID_CPUSET=y
+CONFIG_FAIR_GROUP_SCHED=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_BPF=y
+CONFIG_BPF=y
+CONFIG_BPF_SYSCALL=y
+
+# Container runtime (runc: session keyring, seccomp, cgroup2 device bpf)
+CONFIG_KEYS=y
+CONFIG_SECCOMP=y
+CONFIG_SECCOMP_FILTER=y
+
+# Pod networking: flannel vxlan, CNI bridge/veth, kube-proxy iptables
+CONFIG_VETH=y
+CONFIG_VXLAN=y
+CONFIG_BRIDGE_NETFILTER=y
+CONFIG_NETFILTER_XT_MARK=y
+CONFIG_NETFILTER_XT_NAT=y
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
+CONFIG_NETFILTER_XT_MATCH_COMMENT=y
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y
+CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
+CONFIG_IP_NF_MANGLE=y
+CONFIG_IP_NF_RAW=y
+CONFIG_IP_NF_TARGET_REJECT=y
+CONFIG_IP6_NF_IPTABLES=y
+CONFIG_IP6_NF_FILTER=y
+CONFIG_IP6_NF_MANGLE=y
+CONFIG_IP6_NF_NAT=y
+CONFIG_IP6_NF_TARGET_MASQUERADE=y
+CONFIG_IP6_NF_TARGET_REJECT=y
+CONFIG_NFT_COMPAT=y
+CONFIG_NFT_MASQ=y
+CONFIG_NFT_REJECT=y