Load and persist br_netfilter in a Colima VM from the cluster role #100

After a Colima VM restart, pods can lose every cluster service IP, cluster DNS included, until the Linux VM loads br_netfilter. The README documents the fix (load the module and persist it in /etc/modules-load.d/), but nothing in the cluster role does it, so a rebuilt or new Colima host depends on someone remembering.

Proposal: for a Colima Docker context, the cluster role checks /proc/sys/net/bridge in the VM and, if it is missing, loads the module and writes the persistence file through colima ssh, in check mode reporting the change without making it. It fails loudly if the module cannot be loaded. Docker Desktop and Linux hosts are untouched.

The check belongs with the role's other end checks from the runtime start-at-login work, so one converge proves the VM, the module and the k3s container are all up.