[Day 2 Ops] Certificate Rotation

Part of Day 2 Ops for Imported Clusters. Tracking issue: https://github.com/rancher/rancher/issues/54228

Description

Enable certificate rotation for imported RKE2/K3s clusters.

The existing implementation (CAPR) removes /agent/pod-manifests to force certificate regeneration. This work adapts that plan generation to imported clusters using the public plan library, Beacon-based delivery, and cluster-aware data-directory resolution.

Acceptance criteria

• Certificate rotation can be triggered on an imported cluster
• Plan correctly references the data directory resolved from node.management.cattle.io status annotations
• HTTP probes (etcd, kube-apiserver, kube-scheduler, kube-controller-manager, kubelet, calico) are rendered and tracked
• Operation completes successfully on a real imported RKE2 cluster (integration test)
• Provisioning-v2 certificate rotation is not regressed