rke2: taint control-plane nodes NoSchedule

## Why
- The 3 control-plane/etcd nodes (prodnxsr0001/0002/0003, roles::infra::k8s::control) carry NO taints, so regular workloads schedule onto the controllers.
- Controllers should run only control-plane and tolerating workloads.

## How
- Add `node-taint: node-role.kubernetes.io/control-plane=true:NoSchedule` to `rke2::config_hash` in `hieradata/roles/infra/k8s/control.yaml` (control role only; compute/agent nodes untouched).
- `rke2::config_hash` deep-merges, so the taint layers onto the existing control config and renders into `/etc/rancher/rke2/config.yaml` node-taint list.

hieradata/roles/infra/k8s/control.yaml

@@ -30,6 +30,9 @@ rke2::config_hash:
     - '--node-monitor-period=4s'
   protect-kernel-defaults: true
   disable-kube-proxy: false
+  # taint the control-plane/etcd nodes so only tolerating workloads schedule here
+  node-taint:
+    - "node-role.kubernetes.io/control-plane=true:NoSchedule"
 
 # configure consul service
 consul::services: