fix(kernel): restore desktop capabilities across streams

[ahmedadan]

Summary

Libvirt networking needs kernel traffic-control support for DHCP checksum repair and bandwidth controls. This adds the missing capabilities and ensures shared kernel fixes reach next without replacing its stream-specific kernel versions.

1. Enable virtualization networking support. Add HTB, u32, checksum actions, and bandwidth-control support, plus MACVLAN/MACVTAP for direct-LAN networking. Default networking and queue settings remain unchanged.
2. Complete storage and sensor capabilities. Enable USB UAS and cgroup disk throttling. Add the software-trigger prerequisite needed for OGC’s IIO timer trigger to survive olddefconfig.
3. Keep capability fixes shared across streams. Narrow next-owned configuration to the vendored helpers. Add sync tests covering propagation, kernel-overlay preservation, and rejection of unexpected divergence, and document the ownership boundary.

Verified: just validate, all five sync tests, shell syntax, and whitespace checks passed. Default and NVIDIA-gaming image builds succeeded, including both kernel configuration gates and NVIDIA driver compilation. Local Podman export stopped at interactive sudo authentication.

[github-actions]

Thanks for the PR! A maintainer will review it.

While you wait, make sure these pass locally:

just validate        # element graph check
just build default   # build the image
just boot-test       # confirm the desktop boots (exits 0 = pass)
just lint            # bootc container lint

If this PR fixes a bug, add verify steps to the linked issue so users can confirm the fix on their hardware after the next nightly ships:

```verify
ujust <something>   # what users should run to confirm the fix
```