Add PriorityClass, ArgoCD jenkins-ci token, and Harbor robot secretstores

extra-manifests/priorityclass-high-priority.yaml: cluster-side
PriorityClass backing the app chart's hardcoded priorityClassName.
secretstores/argocd-jenkins-ci-token.yaml: ExternalSecret for the
scoped ArgoCD account devops-lib's syncArgoApp stage authenticates
with.
secretstores/harbor-robot-dockerconfig.yaml: ExternalSecret building a
dockerconfigjson from the Harbor robot account for image pulls.

secretstores/argocd-jenkins-ci-token.yaml

@@ -0,0 +1,31 @@
+# Token for the scoped jenkins-ci ArgoCD account (see
+# argocd-admin-prd/custom-values.yaml's accounts.jenkins-ci) — lets Jenkins
+# trigger a sync of demo-go-app as the pipeline's last step, matching
+# devops-lib's real refresh_and_sync (argocd app sync --hard-refresh).
+#
+# Unlike every other credential in this repo, this one genuinely can't be
+# generated declaratively — ArgoCD only issues account tokens via its own
+# API/CLI, after the account already exists on a running instance. One-time
+# setup, once argocd-admin-prd has synced with the account config above:
+#   kubectl -n argocd port-forward svc/argocd-admin-prd-argocd-server 8080:80 &
+#   argocd login localhost:8080 --insecure --username admin --password '<admin password>'
+#   TOKEN=$(argocd account generate-token --account jenkins-ci)
+#   kubectl -n vault exec -i vault-0 -- vault kv put secret/argocd/jenkins-ci token="$TOKEN"
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: argocd-jenkins-ci-token
+  namespace: jenkins
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: argocd-jenkins-ci-token
+    creationPolicy: Owner
+  data:
+    - secretKey: token
+      remoteRef:
+        key: argocd/jenkins-ci
+        property: token

secretstores/harbor-robot-dockerconfig.yaml

@@ -0,0 +1,40 @@
+# Docker registry credentials for Jenkins to push to Harbor, as a proper
+# kubernetes.io/dockerconfigjson secret (not a plain Opaque one) so it can
+# be mounted straight at ~/.docker/config.json in the build container —
+# docker push/pull read that format natively, no explicit `docker login`
+# step needed in the pipeline itself.
+#
+# Vault-backed, same pattern as everything else. Put the robot account's
+# credentials in first (create it in the Harbor UI: your CI project ->
+# Robot Accounts -> New Robot Account, scoped to push+pull on that one
+# project — Harbor shows the secret once, copy it immediately):
+#   kubectl -n vault exec -i vault-0 -- vault kv put secret/harbor/jenkins-robot \
+#     username='robot$<project>+<robot-name>' \
+#     password='<the generated secret>'
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: harbor-robot-dockerconfig
+  namespace: jenkins
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: harbor-robot-dockerconfig
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {"auths":{"harbor-core.harbor.svc.cluster.local":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
+  data:
+    - secretKey: username
+      remoteRef:
+        key: harbor/jenkins-robot
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: harbor/jenkins-robot
+        property: password