GB200 and newer Ubuntu runtime fixes needed in Cloud Native Stack playbooks

Problem

Cloud Native Stack playbooks currently have a few behaviors that cause problems
on GB200 systems, retry/reapply workflows, and newer Ubuntu runtimes:

• Calico autodetection does not include enP* interfaces.
• GPU Operator install tasks use helm install --generate-name, which is not
  retry-safe.
• Docker CE installs are selected as latest, which can drift between runs and
  does not encode the apt architecture.
• Ubuntu apt repository key tasks still use Ansible apt_key, which depends on
  the deprecated apt-key executable.

Observed Failure

During Ubuntu 26.04 runtime validation, CNS install failed at:

TASK [Add an Kubernetes apt signing key for Ubuntu]

With:

Failed to find required executable "apt-key"

Proposed Fix

Apply the prepared field-fix patch series:

1. Add enP* to Calico autodetection.
2. Convert GPU Operator Helm installs to helm upgrade --install gpu-operator.
3. Add Docker CE version and architecture variables and use pinned apt package
   installs.
4. Replace active Ubuntu apt_key usage with keyring downloads/dearmor and
   signed-by apt repository handling.

Patch commit summary:

• Add enP* as a device prefix for Calico.
• Make GPU Operator install retry-safe.
• Add Docker CE versioning and architecture support.
• Replace apt-key usage for Ubuntu runtimes.

Validation

Local validation passed against the prepared patch series:

• git diff --check
• YAML parse checks for touched YAML files
• Ansible syntax checks for:
  • playbooks/prerequisites.yaml
  • playbooks/nvidia-driver.yaml
  • playbooks/nvidia-docker.yaml
  • playbooks/operators-install.yaml
  • playbooks/k8s-install.yaml
  • playbooks/cns.yaml

Maintainer Review Checklist

• Confirm whether gpu-operator is acceptable as the stable Helm release name.
• Confirm Docker CE version defaults for CNS 16.0, 16.1, and 17.0.
• Confirm the enP* Calico autodetection prefix matches expected GB200 NIC
  naming.
• Confirm keyring paths:
  • /etc/apt/keyrings/kubernetes-apt-keyring.gpg
  • /etc/apt/keyrings/cri-o-apt-keyring.gpg
  • /etc/apt/keyrings/docker.asc
  • /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
• Decide whether to split this into separate PRs by topic or accept as one
  field-fix bundle.

Review the proposed changes in playbooks/prerequisites.yaml, playbooks/nvidia-driver.yaml, playbooks/nvidia-docker.yaml, playbooks/operators-install.yaml, and playbooks/k8s-install.yaml. Start with the maintainer checklist and existing validation commands, then verify the Calico prefix, GPU Operator release name, Docker defaults, and apt keyring paths. Done means the maintainers approve the bundle or its split and all listed YAML and Ansible checks pass.