refactor: keep rke2 archive source in role hiera, not module default

- revert rke2::params container_archive_source to the upstream github default
  so the module stays generic and portable
- set the artifactapi override in the k8s role hiera
  (rke2::container_archive_source) where the estate-specific, pre-CNI-reachable
  source belongs

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

hieradata/roles/infra/k8s.yaml

@@ -11,6 +11,8 @@ hiera_include:
 # manage rke2
 rke2::bootstrap_node: prodnxsr0001.main.unkin.net
 rke2::join_url: https://join-k8s.service.consul:9345
+# pull the airgap image bundle via artifactapi (host-reachable pre-CNI), not github directly
+rke2::container_archive_source: 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download'
 rke2::manage_registries: true
 rke2::registries:
   docker.io:

modules/rke2/manifests/params.pp

@@ -11,7 +11,7 @@ class rke2::params (
   Boolean                 $helm_install = false,
   Hash                    $helm_repos = {},
   Array[String[1]]        $extra_config_files = [],
-  Stdlib::HTTPUrl         $container_archive_source = 'https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/rancher/rke2/releases/download',
+  Stdlib::HTTPUrl         $container_archive_source = 'https://github.com/rancher/rke2/releases/download',
   Boolean                 $manage_registries = false,
   Hash                    $registries = {},
 ) {}