Add demo-go-app-image-pull-secret; rekey harbor-robot-dockerconfig

Both needed for the registry hostname switch to
harbor.192.168.1.7.nip.io (devops-lib#3ffa2d8):

- harbor-robot-dockerconfig's auths key was hardcoded to
  harbor-core.harbor.svc.cluster.local — docker matches stored
  credentials by exact registry hostname, so this had to move with
  the image reference or push would go back to unauthorized.
- New demo-go-app-image-pull-secret, in the demo-go-app namespace
  (imagePullSecrets must be same-namespace as the pod), for the
  Deployment's own pull — separate from harbor-robot-dockerconfig,
  which only ever lived in the jenkins namespace for the build pod's
  push. Same underlying robot account/Vault path.

secretstores/harbor-robot-dockerconfig.yaml

@@ -27,8 +27,14 @@ spec:
     template:
       type: kubernetes.io/dockerconfigjson
       data:
+        # Keyed by exact registry hostname — docker matches credentials
+        # against the host portion of the image reference. Was
+        # harbor-core.harbor.svc.cluster.local; switched to the Contour
+        # ingress hostname alongside buildDocker.groovy and dind-pod.yaml
+        # so push/pull share one consistent, resolvable-from-anywhere
+        # reference.
         .dockerconfigjson: |
-          {"auths":{"harbor-core.harbor.svc.cluster.local":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
+          {"auths":{"harbor.192.168.1.7.nip.io":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
   data:
     - secretKey: username
       remoteRef: