I'm guessing Subscription manager and Puppet end up trying to edit the file at the same time and just destroy it. Anyone have any solutions to this or do I just need to stop forcing the gpgpcheck?

I'm generally not using the stock redhat.repo on any RHEL images, instead disabling all those repos in there and managing my own frozen repos with yum directly. So I'm ignoring the gpgcheck control to avoid conflicts with SCE and

yum

as we do have a couple where we need it disabled.