Talos containerd custom runtime fails to initialize on production nodes

A Talos Linux machine config uses the containerd section to set runtime.untrusted_workload_runtime to kata-runtime. The same configuration boots successfully in a local environment but prevents containerd from starting on production nodes.

The goal is to diagnose whether the failure stems from the minimal production initramfs excluding Kata runtime binaries, stricter SELinux policy, or both. Talos version assumptions matter because the initramfs layout changed after v0.13, and rebuilding the image incorrectly can leave nodes unbootable.

It is unresolved whether Talos should automatically inject required runtime dependencies into the initramfs or expect users to provide them through extensions, and the documentation does not clearly define how extensions are ordered before containerd starts.

Which component is responsible for making a custom runtime available before containerd initializes? Should the machine config declare runtime dependencies explicitly, or is extending the initramfs the supported path for production deployments?