monitor puppet runs

Puppet should be running on all TPO machines. Yet it's not, as far as I can tell, formally monitored in any way.

There should be nagios checks that make sure catalog runs succeeds and run regularly. I deployed such checks at koumbit and it would be fairly easy to do here as well.