Run detached noop agent after k8s migration repoint

site/profiles/manifests/puppet/migrate.pp

@@ -17,6 +17,8 @@
 # still points at it when it applies this change). profiles::puppet::client
 # rewrites puppet.conf with the new server / ca_server / report_server / ssldir
 # and notifies Service['puppet'], so the very next agent run lands on k8s.
+# The puppet.conf change also fires a detached noop run so facts and exported
+# resources register in the k8s PuppetDB immediately.
 #
 # NOTE: this is deliberately hiera-driven per node/role so waves can be rolled
 # out and rolled back one target at a time. The class only manages the fresh
@@ -83,5 +85,15 @@ class profiles::puppet::migrate (
       group  => 'root',
       mode   => '0771',
     }
+
+    exec { 'puppet-migrate-noop-run':
+      command     => join([
+        '/usr/bin/systemd-run --unit=puppet-migrate-noop --collect',
+        '/opt/puppetlabs/bin/puppet agent --onetime --no-daemonize --noop --no-splay --waitforlock 10 --maxwaitforlock 900',
+      ], ' '),
+      unless      => '/usr/bin/systemctl is-active --quiet puppet-migrate-noop',
+      refreshonly => true,
+      subscribe   => File['/etc/puppetlabs/puppet/puppet.conf'],
+    }
   }
 }