OS upgrade complete: Debian 12->13 (trixie) baseline + re-provision role fixes

All 3 k3s nodes re-provisioned to Debian 13 (kernel 6.12) via immutable tofu -replace,
one at a time, leader/primary last. variables.tf image defaults -> trixie generic.
k3s_server role: ensure /etc/rancher/k3s exists (fresh-node re-provision fix).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

infra/ansible/roles/k3s_server/tasks/main.yml

@@ -30,6 +30,14 @@
 # its containerd config.toml (so nonroot-devices takes effect). Apply the restart
 # ROLLING, one node at a time (kube-vip keeps the API reachable; etcd quorum holds
 # at 2/3). See playbooks note: run with `serial: 1`.
+- name: Ensure /etc/rancher/k3s exists (a freshly re-provisioned node has no k3s dir until install)
+  ansible.builtin.file:
+    path: /etc/rancher/k3s
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
 - name: Write /etc/rancher/k3s/config.yaml (tls-san + nonroot-devices + oidc)
   ansible.builtin.copy:
     dest: /etc/rancher/k3s/config.yaml

infra/tofu/variables.tf

@@ -182,7 +182,7 @@ variable "image_source" {
     import + disk-resize under bpg (bpg issue #1639).
   EOT
   type        = string
-  default     = "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-generic-amd64.qcow2"
+  default     = "https://cloud.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2"
 }
 
 variable "image_file_name" {
@@ -194,7 +194,7 @@ variable "image_file_name" {
     panics with "Attempted to kill init" on import + disk-resize (bpg issue #1639).
   EOT
   type        = string
-  default     = "debian-12-generic-amd64.qcow2"
+  default     = "debian-13-generic-amd64.qcow2"
 }
 
 # --- cloud-init identity ----------------------------------------------------