puppet::migrate: drive k8s cutover from a single enabled boolean

Wire profiles::puppet::migrate into profiles::base (shipping enabled=>false)
so every node evaluates it. client.pp now includes migrate and folds
new_server/new_ca_server/new_ssldir into the effective server/ca_server/
report_server/ssldir it renders, so flipping the one
profiles::puppet::migrate::enabled key at any hiera layer (node/role/common)
repoints a target -- no per-node client param overrides.

Explicit client::ssldir/::report_server still override the migrate-derived
value; unmigrated nodes render a byte-identical puppet.conf.

site/profiles/manifests/base.pp

@@ -12,6 +12,9 @@ class profiles::base () {
     # manage the puppet agent
     include profiles::puppet::agent
     include profiles::puppet::client
+    # k8s migration switch; ships disabled, flip its ::enabled boolean in
+    # hiera (node/role/common) to repoint a target onto puppet-on-k8s.
+    include profiles::puppet::migrate
 
     # include the base profiles
     include profiles::base::repos