- Replace static registries.yaml with EPP template driven by rke2::registries hash
- Add disable-default-registry-endpoint: true to all mirrors
- Add docker.litellm.ai and public.ecr.aws registries
- Registry configuration now managed via hiera data in roles/infra/k8s.yaml