fix: mask kubelet before rebuild, unmask in kubeadm helpers

- Mask kubelet service entirely before nixos-rebuild to prevent systemd
  from restarting it during switch
- Unmask kubelet in th-kubeadm-init/join scripts before starting

nixos/kubeadm/modules/k8s-common.nix

@@ -141,6 +141,7 @@ in
         --leaderElection \
         > /etc/kubernetes/manifests/kube-vip.yaml
 
+      systemctl unmask kubelet || true
       systemctl stop kubelet || true
       env -i PATH=/run/current-system/sw/bin:/usr/bin:/bin kubeadm reset -f || true
 
@@ -201,6 +202,7 @@ in
         --leaderElection \
         > /etc/kubernetes/manifests/kube-vip.yaml
 
+      systemctl unmask kubelet || true
       systemctl stop kubelet || true
       eval "$1"
     '')
@@ -213,6 +215,7 @@ in
         exit 1
       fi
 
+      systemctl unmask kubelet || true
       systemctl stop kubelet || true
       eval "$1"
     '')