Scaleway Apple Silicon CAPI: fleet-wide host-config drift detection

Fleet-wide host-config drift for Scaleway Apple Silicon Mac minis. The provider’s drift loop now re-pushes host config to already-provisioned machines whenever a fleet-wide hash of the rendered install scripts (firewall, vmnat, PN interface, launchd job, tailscale, node_exporter, tart-kubelet) and pushed binaries (tart-kubelet, tailscale, node_exporter) changes, rather than only when the tart-kubelet binary SHA changes. Operator fixes that previously had to be hand-applied over SSH and force-patched through the CRs, such as a NAT vlan-detection fix, a pfctl anchor-load fix, or a fleet CIDR/tag change, now roll to existing hosts automatically on the next reconcile. Existing machines get a one-time migration re-push after upgrading, with running Tart VMs preserved.