A package pinned in hieradata right after its RPM lands in artifactapi is
invisible to dnf until the host's 1h cached metadata expires, so the first
Puppet run after a release cannot find the version.
- Set metadata_expire 60s on rpm-internal/rpm-vendor and their per-release
variants for AlmaLinux and Fedora
- Leave upstream mirrors on the 1h default
- Drop the stale expiry note in profiles::dns::updater
unkin-agent