- Replace static registries.yaml with EPP template driven by rke2::registries hash - Add disable-default-registry-endpoint: true to all mirrors - Registry configuration now managed via hiera data in roles/infra/k8s.yaml