Rootless-podman kind: cluster DNS broken (CoreDNS can't reach API) — needs CNI/networking config

[repentsinner]

Problem

With the K8s dev tooling installed (companion to the "Add Kubernetes dev
tooling" issue), kind create cluster on rootless podman succeeds
structurally — the cluster boots, images load (kind load image-archive), Deployments schedule, and real replicas run. But cluster
networking is broken:

• CoreDNS comes up 0/1 with [INFO] plugin/ready: Plugins not ready: "kubernetes" — it cannot reach the kube-apiserver, so all
  in-cluster DNS fails.
• A throwaway pod cannot resolve kubernetes.default or any Service
  (Temporary failure in name resolution).
• Workloads that reach each other by Service name crashloop on
  UNAVAILABLE: ... Timeout while contacting DNS servers.

Observed with kind 0.33.0 + podman 5.8.2, rootless,
KIND_EXPERIMENTAL_PROVIDER=podman, on bluefin-nvidia-open. cgroup
delegation is fine (the cluster boots and schedules); the failure is
CNI / DNS networking — kindnet's API reachability does not work in this
rootless-podman setup.

Proposed

The image's rootless-Kubernetes support should cover CNI / networking,
not just cgroup delegation:

• a kind cluster config / CNI that works rootless on podman (kindnet
  fails here), or
• provide a robust local single-node cluster path — e.g. k3s (flannel
  networking), which is also what production targets, so the dev cluster
  matches the deployment target.

Until then, podman kube play is the only reliable way to run a manifest
locally (it uses podman's own DNS, no CoreDNS) — at the cost of not
exercising replicas/scheduling.

Context

Companion to the "Add Kubernetes dev tooling (kubectl, kind, helm) + a
compose provider" issue: the tooling installs and the cluster boots, but
it is not usable for service-to-service workloads without working DNS.