OS upgrade complete: Debian 12->13 (trixie) baseline + re-provision role fixes

All 3 k3s nodes re-provisioned to Debian 13 (kernel 6.12) via immutable tofu -replace,
one at a time, primary/leader last (secondary-join to avoid cluster-init split-brain).
- variables.tf image defaults -> debian-13-generic (generic, not genericcloud)
- k3s_server: ensure /etc/rancher/k3s exists (fresh-node re-provision fix)
- gitignore vendored ansible collections (installed for re-provision)

Co-Authored-By: Claude Opus 4.8 <[email protected]>

.gitignore

@@ -41,3 +41,6 @@ infra/tofu/.r2.env
 # ignoring it keeps `git add -A` from staging embedded worktree repos and keeps the lint
 # stage (which scans untracked files) from tripping on .claude/worktrees/.
 .claude/
+
+# Vendored ansible collections (installed by ansible-galaxy for node re-provision; not tracked or linted)
+infra/ansible/collections/