Convert RKE2 registries to template, disable default endpoints (#474)

## Summary
- Replace static `registries.yaml` with EPP template driven by `rke2::registries` hash
- Add `disable-default-registry-endpoint: true` to all mirrors — RKE2 will only use artifactapi and never fall back to upstream registries
- Registry configuration now fully managed via hiera data (`roles/infra/k8s.yaml`)

Reviewed-on: #474
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

hieradata/roles/infra/k8s.yaml

@@ -12,6 +12,61 @@ hiera_include:
 rke2::bootstrap_node: prodnxsr0001.main.unkin.net
 rke2::join_url: https://join-k8s.service.consul:9345
 rke2::manage_registries: true
+rke2::registries:
+  docker.io:
+    endpoint:
+      - "https://artifactapi.k8s.syd1.au.unkin.net"
+    rewrite:
+      "^(.*)$": "dockerhub/$1"
+    disable-default-registry-endpoint: true
+  ghcr.io:
+    endpoint:
+      - "https://artifactapi.k8s.syd1.au.unkin.net"
+    rewrite:
+      "^(.*)$": "ghcr/$1"
+    disable-default-registry-endpoint: true
+  quay.io:
+    endpoint:
+      - "https://artifactapi.k8s.syd1.au.unkin.net"
+    rewrite:
+      "^(.*)$": "quay/$1"
+    disable-default-registry-endpoint: true
+  registry.k8s.io:
+    endpoint:
+      - "https://artifactapi.k8s.syd1.au.unkin.net"
+    rewrite:
+      "^(.*)$": "k8s-registry/$1"
+    disable-default-registry-endpoint: true
+  registry.gitlab.com:
+    endpoint:
+      - "https://artifactapi.k8s.syd1.au.unkin.net"
+    rewrite:
+      "^(.*)$": "gitlab/$1"
+    disable-default-registry-endpoint: true
+  docker.elastic.co:
+    endpoint:
+      - "https://artifactapi.k8s.syd1.au.unkin.net"
+    rewrite:
+      "^(.*)$": "elastic/$1"
+    disable-default-registry-endpoint: true
+  gcr.io:
+    endpoint:
+      - "https://artifactapi.k8s.syd1.au.unkin.net"
+    rewrite:
+      "^(.*)$": "gcr/$1"
+    disable-default-registry-endpoint: true
+  docker.litellm.ai:
+    endpoint:
+      - "https://artifactapi.k8s.syd1.au.unkin.net"
+    rewrite:
+      "^(.*)$": "litellm/$1"
+    disable-default-registry-endpoint: true
+  public.ecr.aws:
+    endpoint:
+      - "https://artifactapi.k8s.syd1.au.unkin.net"
+    rewrite:
+      "^(.*)$": "ecr-public/$1"
+    disable-default-registry-endpoint: true
 rke2::config_hash:
   bind-address: "%{hiera('networking_loopback0_ip')}"
   node-ip: "%{hiera('networking_loopback0_ip')}"