fix: download kubeconfig after nodes join the cluster

`tasks/main.yml` fetched `/etc/rancher/rke2/rke2.yaml` from
`groups[rke2_servers_group_name].0`, before `remaining_nodes.yml` ran.
But that file only exists once that host's rke2-server has actually
started, which is true for a fresh bootstrap (`first_server.yml`) but
not when the node at index 0 is instead rejoining an existing cluster -
in that case 'remaining_nodes.yml' is what starts rke2-server on it, and
it runs after the kubeconfig fetch, so the fetch fails.

Move the kubeconfig download after "Prepare and join remaining nodes of
the cluster" so it runs once the index-0 host has a running rke2-server
regardless of which path (bootstrap or join) it took.

Author: Christian Handschuh

tasks/main.yml

@@ -70,18 +70,18 @@
     - inventory_hostname == active_server or inventory_hostname == groups[rke2_servers_group_name].0
     - do_etcd_restore is defined or do_etcd_restore_from_s3 is defined
 
-- name: Download kubeconfig to ansible localhost
-  ansible.builtin.include_tasks: download_kubeconfig.yaml
-  when:
-    - rke2_download_kubeconf | bool
-    - inventory_hostname == groups[rke2_servers_group_name].0
-
 - name: Prepare and join remaining nodes of the cluster
   ansible.builtin.include_tasks: remaining_nodes.yml
   when:
     - active_server is defined
     - groups[rke2_cluster_group_name] | length | int >= 2
 
+- name: Download kubeconfig to ansible localhost
+  ansible.builtin.include_tasks: download_kubeconfig.yaml
+  when:
+    - rke2_download_kubeconf | bool
+    - inventory_hostname == groups[rke2_servers_group_name].0
+
 - name: Rolling cordon and drain restart when version changes - servers
   ansible.builtin.include_tasks: rolling_restart.yml
   with_items: "{{ groups[rke2_servers_group_name] }}"