Convert RKE2 registries to hiera-driven template, disable default endpoints

- Replace static registries.yaml with EPP template driven by rke2::registries hash
- Add disable-default-registry-endpoint: true to all mirrors
- Add docker.litellm.ai and public.ecr.aws registries
- Registry configuration now managed via hiera data in roles/infra/k8s.yaml

hieradata/roles/infra/k8s.yaml

@@ -55,6 +55,18 @@ rke2::registries:
     rewrite:
       "^(.*)$": "gcr/$1"
     disable-default-registry-endpoint: true
+  docker.litellm.ai:
+    endpoint:
+      - "https://artifactapi.k8s.syd1.au.unkin.net"
+    rewrite:
+      "^(.*)$": "litellm/$1"
+    disable-default-registry-endpoint: true
+  public.ecr.aws:
+    endpoint:
+      - "https://artifactapi.k8s.syd1.au.unkin.net"
+    rewrite:
+      "^(.*)$": "ecr-public/$1"
+    disable-default-registry-endpoint: true
 rke2::config_hash:
   bind-address: "%{hiera('networking_loopback0_ip')}"
   node-ip: "%{hiera('networking_loopback0_ip')}"