The rationale here is we don't want to extend trust from the old
machine, which we do by giving them root access on the new server. By
giving root access to the *old* server, we don't give it access to
anything it already has (or will have, in the case of the ganeti
nodes).

While this procedure is available in a billion places already, this is
the kind of stuff that you mess up when you get awaken at 3AM and can
barely type.

Let's see if we can get the human error out of the equation a little
more by helping those poor infected water bags a little.

this is starting to look like a thing ansible should be doing

we could have also used the new swap UUID and edited the fstab, but
that would have required more steps:

 1. mount the filesystem
 2. edit fstab
 3. unmount

... and another thing to redo after the last resync.

By enforcing a UUID from the start, we don't need to edit the fstab at
all. I can't think of a compelling reson why reusing the UUID might be
a problem.