Add PriorityClass, ArgoCD jenkins-ci token, and Harbor robot secretstores

extra-manifests/priorityclass-high-priority.yaml: cluster-side
PriorityClass backing the app chart's hardcoded priorityClassName.
secretstores/argocd-jenkins-ci-token.yaml: ExternalSecret for the
scoped ArgoCD account devops-lib's syncArgoApp stage authenticates
with.
secretstores/harbor-robot-dockerconfig.yaml: ExternalSecret building a
dockerconfigjson from the Harbor robot account for image pulls.

secretstores/harbor-robot-dockerconfig.yaml

@@ -0,0 +1,40 @@
+# Docker registry credentials for Jenkins to push to Harbor, as a proper
+# kubernetes.io/dockerconfigjson secret (not a plain Opaque one) so it can
+# be mounted straight at ~/.docker/config.json in the build container —
+# docker push/pull read that format natively, no explicit `docker login`
+# step needed in the pipeline itself.
+#
+# Vault-backed, same pattern as everything else. Put the robot account's
+# credentials in first (create it in the Harbor UI: your CI project ->
+# Robot Accounts -> New Robot Account, scoped to push+pull on that one
+# project — Harbor shows the secret once, copy it immediately):
+#   kubectl -n vault exec -i vault-0 -- vault kv put secret/harbor/jenkins-robot \
+#     username='robot$<project>+<robot-name>' \
+#     password='<the generated secret>'
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: harbor-robot-dockerconfig
+  namespace: jenkins
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: harbor-robot-dockerconfig
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {"auths":{"harbor-core.harbor.svc.cluster.local":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
+  data:
+    - secretKey: username
+      remoteRef:
+        key: harbor/jenkins-robot
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: harbor/jenkins-robot
+        property: password