iac: harden node lifecycle — tofu for_each + self-contained ansible rejoin

Implements T-1.5 findings F1/F2 (author-first, no cluster change).

F1 (tofu): refactor libvirt node resources count -> for_each keyed by
node name so single-node -replace/destroy cannot cascade to siblings.
Add ordered-list/primary helper locals; update outputs.tf off the map;
add moved.tf (12 moved blocks). tofu plan proves a pure state-address
migration: 0 to add, 0 to change, 0 to destroy (all 12 'has moved to').
State-persist via a 0-change apply is operator-permission-gated.

F2 (ansible): k3s_server secondary fetches the join token via
delegate_to the primary (published fact as fast path), so a single-node
rejoin with --limit k3s-dev-N is self-contained and no longer depends on
a fact an earlier play had to set. Syntax-check + CI gate green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

DECISIONS-LOG.md

@@ -78,8 +78,18 @@ primary play runs, so a limit that excludes the primary yields
   play must have populated in the same run. Then a true single-node rejoin (`--limit k3s-dev-N`) works
   hands-off, which is the T-1.5 durability bar.
 
-Both fixes are **IaC-hardening items for Phase 2** (no cluster change now; the running cluster is
-healthy). Logged here; not yet applied.
+### F1 / F2 — IMPLEMENTED (author-first, 2026-08-16)
+- **F1 done:** `infra/tofu/main.tf` node resources refactored `count` → `for_each` (keyed by node
+  name); ordered-list/`primary` helper locals added; `outputs.tf` updated off the map; **`moved.tf`**
+  adds 12 `moved` blocks (os/data/seed/domain × 3). `tofu validate` OK and **`tofu plan` = `0 to add,
+  0 to change, 0 to destroy`** with all 12 resources reported "has moved to" — a pure state-address
+  rename, no VM churn. **State-persist pending:** a follow-up `tofu apply` (a proven 0-change apply
+  that only rewrites state addresses) is operator-permission-gated; until then the migration re-shows
+  harmlessly on each plan and lands automatically on the next real apply.
+- **F2 done:** `roles/k3s_server/tasks/main.yml` — secondary now fetches the join token via
+  `delegate_to: primary` (with the published fact as a fast path), so `--limit k3s-dev-N` rejoin is
+  self-contained. `ansible-playbook --syntax-check` OK on all playbooks; role lint clean under the CI
+  gate (`make -C ci gate` PASS). No cluster change; the running cluster is untouched.
 
 ## KNOWN ISSUES to fix before Phase-2 un-suspend (logged, not yet fixed)
 | # | Issue | Impact | Fix |