Step 4 only rewrote the list-membership form (product in [...,"rhel9"]), so
the shared rules using the equality form (product == "rhel9") fell through to
the generic else branch for almalinux9. Most visibly,
configure_custom_crypto_policy_cis dropped NO-SSHWEAKCIPHERS/NO-SSHWEAKMACS/
NO-WEAKMAC/NO-RPMSHA1, weakening the CIS crypto remediation vs the rhel9 base
(no hard failure since NO-SHA1 still ships on EL9). Now almalinux9 follows the
rhel9 branch.
Also set auto_increment on the .alma.1 release suffix.
