OS upgrade complete: Debian 12->13 (trixie) baseline + re-provision role fixes

All 3 k3s nodes re-provisioned to Debian 13 (kernel 6.12) via immutable tofu -replace,
one at a time, leader/primary last. variables.tf image defaults -> trixie generic.
k3s_server role: ensure /etc/rancher/k3s exists (fresh-node re-provision fix).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

infra/ansible/roles/k3s_server/tasks/main.yml

@@ -30,6 +30,14 @@
 # its containerd config.toml (so nonroot-devices takes effect). Apply the restart
 # ROLLING, one node at a time (kube-vip keeps the API reachable; etcd quorum holds
 # at 2/3). See playbooks note: run with `serial: 1`.
+- name: Ensure /etc/rancher/k3s exists (a freshly re-provisioned node has no k3s dir until install)
+  ansible.builtin.file:
+    path: /etc/rancher/k3s
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
 - name: Write /etc/rancher/k3s/config.yaml (tls-san + nonroot-devices + oidc)
   ansible.builtin.copy:
     dest: /etc/rancher/k3s/config.yaml