Pin puppet master to a single Recreate replica

The puppet MASTER is the singleton CA/master: a second master, even
transiently during a rolling update, races on CA/cert signing and shared
state. It was previously driven by an HPA (minReplicas 2, maxReplicas 5)
with a RollingUpdate strategy, so 2-5 masters could coexist and a rollout
would briefly run old+new masters against the same shared CA PVC.

- Set puppetserver-master replicas to 1 and strategy to Recreate so the
  old master always terminates before a new one starts.
- Remove the puppetserver-masters-autoscaler HPA (and its kustomization
  entry) that forced 2-5 master replicas.
- Refresh the master VPA note to reflect the pinned-singleton, no-HPA state.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

apps/base/puppet/kustomization.yaml

@@ -23,7 +23,6 @@ resources:
   - deployment_puppetdb.yaml
   - deployment_puppetserver-master.yaml
   - horizontalpodautoscaler_puppetserver-compilers-autoscaler.yaml
-  - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
   - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
   - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
   - gateway_puppetboard.yaml