Is there a Puppet core fact that could tell the timestamp when a node joined Puppet for the first time, i.e. when a node ran the agent for the first time?
Something like last_run, only for the first run.
EDIT: if not, can this be retrieved from any well-known module?
To the best of my knowledge, Puppet does not itself keep any timestamp of clients' first runs that could be queried to provide the information. I do not know of any module that does so, either, but it wouldn't be too hard to roll your own. Of course, that only helps for a given machine if the module is already installed before that machine's first catalog request.
If you are using Puppet's internal CA, you could get a lower bound on the time of the first run from the timestamp on the CA's copy of the node's signed cert. That will often correspond to the time of the first catalog run, though it doesn't need to do. And this scheme blows up if you issue new certificates to existing machines.