Upgrade Kubernetes before 1.31 EOL (2026-10-28)

Kubernetes 1.31 reaches end-of-life on **2026-10-28**. After that no more patch releases or CVE fixes.

Currently on \`v1.31.14\` (post-upgrade from \`v1.31.0\`).

## Plan
- Bump one minor at a time: 1.31 → 1.32 → 1.33 → 1.34. Each minor needs its own apt repo switch + GPG key + \`kubeadm upgrade plan && apply\`.
- Wait a few days between minors to surface regressions.
- Match \`cri-o\` minor in lockstep (currently \`1.30.10\`, bump to 1.31 then 1.32 etc.).
- Read \"Urgent Upgrade Notes\" in each release's [changelog](https://kubernetes.io/releases/) before applying — flagged breaking removals (FlowSchema v1beta3, etc.).

## Deadline
Be on 1.32+ before 2026-10-28. Aim for 2026-09 latest.

Refs:
- https://kubernetes.io/releases/patch-releases/
- https://kubernetes.io/releases/version-skew-policy/