fix: make Rancher image pre-pull best effort and disable managed SUC

Docker Hub TLS handshakes are too flaky to make pre-pulling a hard bootstrap
requirement. Treat image pre-pull as opportunistic and disable Rancher's
managed system-upgrade-controller feature so that image is removed from the
critical install path while Rancher and its webhook converge.

ansible/roles/rancher-image-prepull/tasks/main.yml

@@ -7,3 +7,4 @@
   until: rancher_image_pull.rc == 0
   loop: "{{ rancher_images_to_prepull }}"
   changed_when: true
+  failed_when: false

infrastructure/addons/rancher/helmrelease-rancher.yaml

@@ -28,6 +28,8 @@ spec:
     extraEnv:
       - name: CATTLE_PROMETHEUS_METRICS
         value: "true"
+      - name: CATTLE_FEATURES
+        value: "managed-system-upgrade-controller=false"
     resources:
       requests:
         cpu: 500m