fix: apply k3s version bumps declaratively through site.yml (#544)

Re-running site.yml with a raised k3s_version replaced the on-disk
binary but left agents and joined servers running the old runtime,
because the install script skips the service start and the roles only
restarted the service on a config change. A version-only bump was
therefore not applied until the services were restarted by hand.

Always restart the k3s service in the server and agent roles on a
site.yml run, so the cluster reliably picks up a new config or runtime
without any logic to detect whether the binary changed. On a
multi-server cluster, run the playbook with --forks=1 so the servers
restart one at a time and the etcd quorum is preserved; document this
in the README.

Keep the dedicated upgrade.yml integration test and add a second
upgrade through site.yml, asserting the running version the kubelet
reports rather than the on-disk binary, so the tests fail if the
restart regresses.



Assisted-By: Claude <noreply@anthropic.com>

Signed-off-by: Aleksei Sviridkin <f@lex.la>

roles/k3s_agent/tasks/main.yml

@@ -95,8 +95,12 @@
   loop:
     - "K3S_TOKEN={{ token }}"
 
+# Always restart so a re-run of site.yml — whether it changed the agent config
+# or bumped k3s_version — reliably brings the agent onto the new state. The
+# install script leaves the service stopped (INSTALL_K3S_SKIP_START), so a plain
+# restart also covers the first install.
 - name: Enable and start K3s agent
   ansible.builtin.service:
     name: k3s-agent
-    state: "{{ 'restarted' if _agent_config_result.changed else 'started' }}"
+    state: restarted
     enabled: true