Primary server detection previously used ansible_default_ipv4.address compared against
k3s_primary_server_ip, which breaks with --limit since facts are only gathered for the
targeted hosts, causing the variable to resolve to the wrong IP.
- Replace IP comparisons with `inventory_hostname == groups['k3s_server'] | first`
in main.yaml (primary install, secondary install, kubeconfig tasks)
- Delegate the node-token slurp to the primary server unconditionally so
pull_token.yaml works correctly when run against any single node with --limit
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>