rke2,puppet: enforce versionlock before package install

A versionlock is useless if the package resource is evaluated before the
lock is in place: dnf upgrades the package to an unpinned version, then the
lock pins whatever landed. This is the drift that let new RKE2 nodes boot
1.33.11 instead of the pinned version.

Order the versionlock ahead of the package everywhere the two lacked a
relationship:

- rke2::install adds before => Package["rke2-${node_type}"] on the
  versionlock so the lock exists before install/upgrade.
- profiles::puppet::agent (RedHat) adds before => Package[$use_package] on
  the versionlock for the same reason.

profiles::gitea::runner and profiles::vault::server already ordered the
versionlock ahead of the package (before => Package / before => Class) and
are unchanged. Locked versions themselves are untouched.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

modules/rke2/manifests/install.pp

@@ -6,10 +6,11 @@ class rke2::install (
   Stdlib::HTTPUrl         $container_archive_source = $rke2::container_archive_source,
 ){
 
-  # versionlock rke2
+  # versionlock rke2 before install so the lock exists before any upgrade is attempted
   yum::versionlock{"rke2-${node_type}":
     ensure  => present,
     version => "${rke2_version}~${rke2_release}",
+    before  => Package["rke2-${node_type}"],
   }
 
   # install rke2

site/profiles/manifests/puppet/agent.pp

@@ -60,10 +60,11 @@ class profiles::puppet::agent (
         require => Yumrepo[$use_yumrepo],
       }
 
-      # versionlock puppet-agent
+      # versionlock puppet-agent before install so the lock exists before any upgrade is attempted
       yum::versionlock{$use_package:
         ensure  => $agent_versionlock_ensure,
         version => $agent_versionlock_version,
+        before  => Package[$use_package],
       }
     }
     'Debian': {