GKE: register the remaining tools, add the registry CA issuer

Adds nine Applications — external-secrets, harbor, jenkins, postgresql,
redis, victoria-metrics-single, vmagent, node-exporter, grafana — bringing
the cluster to the homelab's full set. Every nameOverride is pinned, which
is load-bearing rather than cosmetic in at least three cases:
external-secrets (its service account name is what vault-backend's
serviceAccountRef and Vault's auth role bind to), victoria-metrics-single
(its Service renders as <release>-server, the address vmagent and Grafana
both hardcode) and harbor (the pipeline refers to its object names).

extra-manifests gains the ClusterIssuer that makes cert-manager useful
here: a CA issuer over the registry-ca Secret, which is created by hand
from terraform output because the CA's private key exists only in
Terraform state and nothing can reconcile it from git.

Two homelab-only things removed rather than left to confuse: the Tailscale
Harbor Ingress, and the homelab cluster's own entry point and values file,
which have no meaning in a GCP-only repo. app-of-secretstores and
app-of-extra-manifests now point at this cluster's Gitea over cluster DNS,
and harbor-robot-dockerconfig is keyed to this cluster's registry hostname
— docker matches stored credentials by exact host, so the homelab's would
have silently pushed unauthenticated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

values/incubator-infra-gke-toolshed-prd-usc1-values.yaml

@@ -70,3 +70,73 @@ appSpec:
     # cert-manager's CRDs embed large OpenAPI schemas; SSA avoids the
     # 256KiB last-applied-configuration limit, same as external-secrets.
     serverSideApply: true
+  - name: external-secrets
+    # Every credential in the cluster arrives through this. nameOverride is
+    # not cosmetic here: without it the release becomes
+    # "external-secrets-<cluster>-<env>", which renames the controller's
+    # service account — and both secretstores/vault-backend.yaml's
+    # serviceAccountRef and Vault's own Kubernetes auth role are bound to
+    # the plain name.
+    nameOverride: external-secrets
+    namespace: external-secrets
+    chartDir: external-secrets
+    valuesDir: external-secrets
+    # ClusterSecretStore's CRD embeds a large provider schema and exceeds
+    # the 256KiB annotation limit on a client-side apply.
+    serverSideApply: true
+  - name: harbor
+    # Object names are all prefixed with the release name, and the pipeline
+    # refers to them, so it is pinned.
+    nameOverride: harbor
+    namespace: harbor
+    chartDir: harbor
+    valuesDir: harbor
+  - name: jenkins
+    nameOverride: jenkins
+    namespace: jenkins
+    chartDir: jenkins
+    valuesDir: jenkins
+  - name: postgresql
+    # Backs toolshed's control plane. Own namespace so it is addressed over
+    # cluster DNS like any other platform component and outlives whatever
+    # consumes it: postgresql.postgres.svc.cluster.local:5432
+    nameOverride: postgresql
+    namespace: postgres
+    chartDir: postgresql
+    valuesDir: postgresql
+  - name: redis
+    # Backs toolshed's managed cache add-on, same namespace reasoning as
+    # postgresql: redis.redis.svc.cluster.local:6379
+    nameOverride: redis
+    namespace: redis
+    chartDir: redis
+    valuesDir: redis
+  - name: victoria-metrics-single
+    # Pinned name, because the chart renders its Service as
+    # <release>-server and both vmagent's remote write and Grafana's
+    # datasource address it at
+    # victoria-metrics-single-server.monitoring.svc.cluster.local:8428
+    nameOverride: victoria-metrics-single
+    namespace: monitoring
+    chartDir: victoria-metrics-single
+    valuesDir: victoria-metrics-single
+  - name: vmagent
+    # The scraper. Needs the Service above to exist, so bring it up after.
+    nameOverride: vmagent
+    namespace: monitoring
+    chartDir: vmagent
+    valuesDir: vmagent
+  - name: node-exporter
+    nameOverride: node-exporter
+    namespace: monitoring
+    chartDir: node-exporter
+    valuesDir: node-exporter
+  - name: grafana
+    # Requires secretstores/grafana-admin-credentials.yaml to have synced
+    # first: without that Secret the pod generates a random admin password
+    # nobody has. It does not crash, it just cannot be logged into until
+    # the Secret exists and the pod restarts.
+    nameOverride: grafana
+    namespace: monitoring
+    chartDir: grafana
+    valuesDir: grafana