Add profiles::puppet::migrate to repoint VM agents onto puppet-on-k8s

Migrate VM puppet agents off the legacy VM puppetmasters and onto the new
puppet-on-kubernetes servers, per-wave via hiera and reversible without
re-enrolment. Changing server/ca_server alone is insufficient: the agent's
ssldir holds a cert signed by the OLD CA that the new CA neither trusts nor
recognises. This switches migrated nodes to a FRESH ssldir so the agent
generates a new CSR (autosigned on the k8s CA) while the old creds stay on
disk for rollback.

- Add profiles::puppet::migrate: opt-in (hiera_include) toggle that owns the
  fresh ssldir directory and documents per-node/per-role/common wiring plus
  rollback in its class header.
- Extend profiles::puppet::client with optional $ssldir and $report_server
  params (default undef); the ERB template omits both lines when unset, so
  unmigrated nodes render a byte-identical puppet.conf.
- puppet.conf stays owned solely by client.pp's template; migrate.pp adds no
  competing File resource.

site/profiles/manifests/puppet/client.pp

@@ -4,17 +4,19 @@
 #
 # site/profile/manifests/puppet/client.pp
 class profiles::puppet::client (
-  Array  $dns_alt_names       = [$trusted['certname']],
-  String $server              = 'puppetmaster',
-  String $ca_server           = 'puppetca',
-  String $environment         = 'develop',
-  Integer $runinterval        = 1800,
-  Integer $runtimeout         = 3600,
-  Boolean $show_diff          = true,
-  Boolean $usecacheonfailure  = false,
-  Integer $facts_soft_limit   = 4096,
-  Boolean $splay              = true,
-  Integer $splaylimit         = 600,
+  Array  $dns_alt_names                  = [$trusted['certname']],
+  String $server                         = 'puppetmaster',
+  String $ca_server                      = 'puppetca',
+  Optional[String] $report_server        = undef,
+  String $environment                    = 'develop',
+  Integer $runinterval                   = 1800,
+  Integer $runtimeout                    = 3600,
+  Boolean $show_diff                     = true,
+  Boolean $usecacheonfailure             = false,
+  Integer $facts_soft_limit              = 4096,
+  Boolean $splay                         = true,
+  Integer $splaylimit                    = 600,
+  Optional[Stdlib::Absolutepath] $ssldir = undef,
 ) {
 
   # dont manage puppet.conf if this is a puppetmaster