Dual-write ENC data into encapi alongside Cobbler

Seed encapi (statuses, roles, prodnxsr node assignments) and make the
instance module also create an encapi_node for every VM, so the k8s
puppetserver ENC can cut over from Cobbler. Cobbler/puppetca/puppetdb
resources are left untouched.

- Add config/encapi leaf + modules/encapi driving statuses/roles/nodes
  from YAML (3 statuses, 51 roles, 13 prodnxsr physical nodes).
- Add encapi_node to modules/instance (certname, role, environment).
- Wire encapi provider into root.hcl required_providers and the module
  providers; plumb ENCAPI_WRITE_TOKEN via Makefile vault_env.

config/encapi/statuses.yaml

@@ -0,0 +1,10 @@
+# encapi statuses == Puppet environments (Cobbler "status").
+# Seeded from what the estate actually runs (all nodes today report
+# catalog_environment=develop) plus production (the environment the incus
+# instance module pins via puppetca_certificate) and testing (implicit).
+production:
+  description: Production environment
+develop:
+  description: Development environment (current default across the estate)
+testing:
+  description: Implicit/transient environment