puppet::migrate: drive k8s cutover from a single enabled boolean

Wire profiles::puppet::migrate into profiles::base (shipping enabled=>false)
so every node evaluates it. client.pp now includes migrate and folds
new_server/new_ca_server/new_ssldir into the effective server/ca_server/
report_server/ssldir it renders, so flipping the one
profiles::puppet::migrate::enabled key at any hiera layer (node/role/common)
repoints a target -- no per-node client param overrides.

Explicit client::ssldir/::report_server still override the migrate-derived
value; unmigrated nodes render a byte-identical puppet.conf.

site/profiles/templates/puppet/client/puppet.conf.erb

@@ -1,15 +1,15 @@
 [main]
 dns_alt_names = <%= @dns_alt_names_string %>
-<% unless @ssldir.nil? -%>
-ssldir = <%= @ssldir %>
+<% unless @effective_ssldir.nil? -%>
+ssldir = <%= @effective_ssldir %>
 <% end -%>
 
 [agent]
-server = <%= @server %>
-ca_server = <%= @ca_server %>
+server = <%= @effective_server %>
+ca_server = <%= @effective_ca_server %>
 environment = <%= @environment %>
 report = true
-report_server = <%= @report_server.nil? ? @server : @report_server %>
+report_server = <%= @effective_report_server.nil? ? @effective_server : @effective_report_server %>
 runinterval = <%= @runinterval %>
 runtimeout = <%= @runtimeout %>
 show_diff = <%= @show_diff %>