Auto-recovery for silent lockups on bare-metal Kura nodes

Kura bare-metal deployments now recover automatically when a single box silently locks up. Nodes are hardened to reboot within about 30 seconds of a kernel lockup via a systemd watchdog and panic sysctls, keeping the local cache intact. A MachineHealthCheck per fleet also reinstalls a box that stays NotReady for 10 minutes, so a single frozen node can no longer wedge the entire deploy pipeline.