GKE: point the pipeline at this cluster's registry, over TLS

The GCP counterpart of devops-lib. Registered in Jenkins under the same
name, so consuming repos need no change: the two-line Jenkinsfile is
identical on both clusters, and which library it resolves to is a property
of the Jenkins running it.

Substantive changes, all consequences of GKE being a real cloud:

- Harbor speaks TLS here, so dind no longer passes --insecure-registry.
  It mounts the private CA at
  /etc/docker/certs.d/harbor.35.238.248.203.nip.io/ca.crt instead, from the
  registry-ca ConfigMap. This is not redundant with the node pool's trust:
  that covers pulls, performed by containerd on the node, while the push
  comes from dockerd in the build pod with its own trust store. Without it,
  pushes fail TLS verification while pulls of the same image succeed —
  which reads like a broken registry rather than a missing trust anchor.

- The registry hostname changes in the push target and all five fallback
  Dockerfiles. It still must be spelled identically everywhere, because
  Docker matches credentials and trust by exact hostname.

- helm_repo_url moves to cluster DNS. That clone runs in a build pod, so
  sending it out through the ingress and back would make the pipeline
  depend on Contour for pod-to-pod traffic. syncArgoApp already addressed
  ArgoCD this way and needed no change.

- build-tools.Dockerfile is removed: devops-base-images-gcp owns it now,
  next to the mirrored base images, and the pod references the result by
  tag at base-images/build-tools:1. The base-images project is public, so
  the pod can pull it before it has any credentials.

Verified: no homelab addresses remain; the pod template parses with the CA
mount, the new image and no insecure-registry flag; and every fallback
template's base image, with the default version buildDocker would pick, is
present in the mirror manifest — an unmirrored tag now fails the build
rather than silently falling back to Docker Hub.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

resources/org/homelab/dind-pod.yaml

@@ -15,32 +15,47 @@ spec:
       image: docker:27-dind
       securityContext:
         privileged: true
-      # Harbor's ingress serves plain HTTP too (TLS disabled cluster-wide
-      # by design — see claude.md's "everything is plain HTTP" note).
-      # Docker defaults to attempting HTTPS against any bare registry
-      # hostname regardless of network path, so this is needed
-      # regardless of which hostname is used — was previously
-      # harbor-core.harbor.svc.cluster.local (cluster-internal Service
-      # DNS, works from this pod but not from the node's own containerd
-      # when pulling for a real Deployment); switched to the Contour
-      # ingress hostname so push and pull can share one reference.
-      args:
-        - "--insecure-registry=harbor.192.168.1.7.nip.io"
+      # No --insecure-registry, unlike the homelab: Harbor here serves a real
+      # certificate, issued by cert-manager from the private CA that the node
+      # pool was told to trust when it was created.
+      #
+      # That node trust covers image PULLS, which containerd performs on the
+      # node. This push is a different client — dockerd, inside this pod,
+      # with its own trust store and no knowledge of what the node trusts —
+      # so it needs the CA mounted itself. dockerd looks it up at
+      # /etc/docker/certs.d/<registry host>/ca.crt, and the directory name
+      # must be the registry hostname exactly; anything else is silently
+      # ignored, and the push then fails TLS verification while a pull of the
+      # very same image works.
+      #
+      # The registry hostname (rather than harbor-core.harbor.svc.cluster.local)
+      # carries over unchanged from the homelab, for a reason that still
+      # holds: cluster DNS resolves from this pod but not from the node's
+      # containerd doing the real Deployment pull, and Docker matches both
+      # stored credentials and trust by exact hostname — so push and pull
+      # have to name the registry identically.
       env:
         - name: DOCKER_TLS_CERTDIR
           value: ""
       volumeMounts:
         - name: docker-graph-storage
           mountPath: /var/lib/docker
+        - name: registry-ca
+          mountPath: /etc/docker/certs.d/harbor.35.238.248.203.nip.io
+          readOnly: true
     - name: docker-cli
-      # Custom image (see build-tools.Dockerfile in this same directory)
-      # — bakes in git/yq/bash/python3+pip/venv/curl so nothing needs
-      # apk-installing or curl-downloading on every single build (was
-      # slow and, per its own point, defeats the purpose of a
-      # reproducible pipeline to be quietly downloading a tool binary
-      # fresh on every run). Versioned tag, not :latest — a rebuild of
-      # the tools image doesn't roll out until this pin is bumped too.
-      image: harbor.192.168.1.7.nip.io/homelab/build-tools:1
+      # Custom image, built and pushed by hand from devops-base-images-gcp
+      # (build-tools.Dockerfile there) — bakes in git/yq/bash/python3 with
+      # pip and venv/curl so nothing needs installing on every single build,
+      # which was slow and quietly undermined reproducibility.
+      #
+      # It lives in the base-images project rather than homelab because that
+      # project is public: this pod pulls the image before any credential is
+      # available to it.
+      #
+      # Versioned tag, never :latest — rebuilding the tools image must not
+      # roll out until this pin is bumped deliberately.
+      image: harbor.35.238.248.203.nip.io/base-images/build-tools:1
       command: ["cat"]
       tty: true
       env:
@@ -77,6 +92,13 @@ spec:
   volumes:
     - name: docker-graph-storage
       emptyDir: {}
+    - name: registry-ca
+      configMap:
+        # Published by devops-infra-argo-config-gcp (extra-manifests). The
+        # CA's public certificate only — its private key never leaves
+        # Terraform state and cert-manager, which is why this is a ConfigMap
+        # rather than a Secret.
+        name: registry-ca
     - name: docker-config
       secret:
         secretName: harbor-robot-dockerconfig