fix: reinstall k3s on version drift

ansible/roles/k3s-server/tasks/main.yml

@@ -11,9 +11,21 @@
   failed_when: false
   when: k3s_service.stat.exists
 
+- name: Check installed k3s version
+  command: k3s --version
+  register: installed_k3s_version
+  changed_when: false
+  failed_when: false
+  when: k3s_service.stat.exists
+
 - name: Determine whether k3s install is needed
   set_fact:
-    k3s_install_needed: "{{ (not k3s_service.stat.exists) or ((k3s_service_state.stdout | default('')) != 'active') }}"
+    k3s_install_needed: >-
+      {{
+        (not k3s_service.stat.exists)
+        or ((k3s_service_state.stdout | default('')) != 'active')
+        or (k3s_version != 'latest' and k3s_version not in (installed_k3s_version.stdout | default('')))
+      }}
 
 - name: Wait for API endpoint on 6443 (secondary only)
   wait_for: