Run detached noop agent after k8s migration repoint (#561)

Migrated nodes have no facts or exported resources in the k8s PuppetDB until their next agent run (up to splay + runinterval), which breaks exported-resource discovery for services migrated as a group. A noop run registers both at compile time.

- add a refreshonly exec in profiles::puppet::migrate, subscribed to puppet.conf, that launches a detached noop agent run via systemd-run
- skip the exec while a previous puppet-migrate-noop unit is still active

Reviewed-on: #561
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

site/profiles/manifests/puppet/migrate.pp

@@ -17,6 +17,8 @@
 # still points at it when it applies this change). profiles::puppet::client
 # rewrites puppet.conf with the new server / ca_server / report_server / ssldir
 # and notifies Service['puppet'], so the very next agent run lands on k8s.
+# The puppet.conf change also fires a detached noop run so facts and exported
+# resources register in the k8s PuppetDB immediately.
 #
 # NOTE: this is deliberately hiera-driven per node/role so waves can be rolled
 # out and rolled back one target at a time. The class only manages the fresh
@@ -83,5 +85,15 @@ class profiles::puppet::migrate (
       group  => 'root',
       mode   => '0771',
     }
+
+    exec { 'puppet-migrate-noop-run':
+      command     => join([
+        '/usr/bin/systemd-run --unit=puppet-migrate-noop --collect',
+        '/opt/puppetlabs/bin/puppet agent --onetime --no-daemonize --noop --no-splay --waitforlock 10 --maxwaitforlock 900',
+      ], ' '),
+      unless      => '/usr/bin/systemctl is-active --quiet puppet-migrate-noop',
+      refreshonly => true,
+      subscribe   => File['/etc/puppetlabs/puppet/puppet.conf'],
+    }
   }
 }