Step 5 only rewrote the list-membership form (product in [...,"rhel10"]),
so the 7 shared rules using the equality form (product == "rhel10") fell
through to the generic else branch for almalinux10. Most visibly,
configure_custom_crypto_policy_cis emitted DEFAULT:NO-SHA1, but the NO-SHA1
subpolicy module was dropped from crypto-policies on EL10, so
'update-crypto-policies --set DEFAULT:NO-SHA1:NO-SSHCBC' failed. Now
almalinux10 follows the rhel10 branch (DEFAULT + self-created modules).
Also set auto_increment on the .alma.1 release suffix.
Andrew Lukoshko
c2670e5d11