## Why
- The 3 control-plane/etcd nodes (prodnxsr0001/0002/0003, roles::infra::k8s::control) carry NO taints, so regular workloads schedule onto the controllers.
- Controllers should run only control-plane and tolerating workloads.
## How
- Add `node-taint: node-role.kubernetes.io/control-plane=true:NoSchedule` to `rke2::config_hash` in `hieradata/roles/infra/k8s/control.yaml` (control role only; compute/agent nodes untouched).
- `rke2::config_hash` deep-merges, so the taint layers onto the existing control config and renders into `/etc/rancher/rke2/config.yaml` node-taint list.
unkinben