puppet::migrate: drive k8s cutover from a single enabled boolean

Wire profiles::puppet::migrate into profiles::base (shipping enabled=>false)
so every node evaluates it. client.pp now includes migrate and folds
new_server/new_ca_server/new_ssldir into the effective server/ca_server/
report_server/ssldir it renders, so flipping the one
profiles::puppet::migrate::enabled key at any hiera layer (node/role/common)
repoints a target -- no per-node client param overrides.

Explicit client::ssldir/::report_server still override the migrate-derived
value; unmigrated nodes render a byte-identical puppet.conf.

site/profiles/manifests/puppet/client.pp

@@ -19,6 +19,49 @@ class profiles::puppet::client (
   Optional[Stdlib::Absolutepath] $ssldir = undef,
 ) {
 
+  # Pull in the k8s-migration switch. When
+  # profiles::puppet::migrate::enabled is true at ANY hiera layer
+  # (node/role/common) the effective endpoints below flip to the k8s
+  # servers and a fresh ssldir -- no other hiera keys required. This class
+  # never includes client.pp, so there is no include cycle.
+  include profiles::puppet::migrate
+
+  # Effective values fed to the template. Precedence differs by param type:
+  #
+  #   ssldir / report_server (Optional, default undef): an explicit client
+  #     param wins; else the migrate-derived value when enabled; else the
+  #     legacy default (undef -> template omits ssldir; report_server -> server).
+  #
+  #   server / ca_server (String, no undef sentinel): the migrate value wins
+  #     when migrate::enabled, otherwise the client param (which is the legacy
+  #     default unless an operator set it explicitly in hiera). To pin a
+  #     bespoke server while enabled, leave enabled => false for that target
+  #     and set profiles::puppet::client::server directly.
+  $migrate_on = $profiles::puppet::migrate::enabled
+
+  $effective_server = $migrate_on ? {
+    true    => $profiles::puppet::migrate::new_server,
+    default => $server,
+  }
+  $effective_ca_server = $migrate_on ? {
+    true    => $profiles::puppet::migrate::new_ca_server,
+    default => $ca_server,
+  }
+  # report_server: explicit param wins; else follow the effective server.
+  $effective_report_server = $report_server ? {
+    undef   => $effective_server,
+    default => $report_server,
+  }
+  # ssldir: explicit param wins; else the fresh k8s ssldir when migrating;
+  # else undef (template omits the key, i.e. puppet's built-in default).
+  $effective_ssldir = $ssldir ? {
+    undef   => $migrate_on ? {
+      true    => $profiles::puppet::migrate::new_ssldir,
+      default => undef,
+    },
+    default => $ssldir,
+  }
+
   # dont manage puppet.conf if this is a puppetmaster
   if $facts['enc_role'] != 'roles::infra::puppet::master' {