Mark harbor-core as an insecure registry for dockerd

docker push was hanging: "Client.Timeout exceeded while awaiting
headers" doing a TLS handshake against harbor-core.harbor.svc.cluster.local,
which only ever speaks plain HTTP (TLS disabled cluster-wide by
design). Docker defaults to HTTPS for any bare registry hostname
regardless of network path — that default has nothing to do with
whether traffic routes through Contour/Ingress, contrary to what an
earlier pending-items note assumed. Adds --insecure-registry to the
dind container's dockerd startup args.

resources/org/homelab/dind-pod.yaml

@@ -15,6 +15,16 @@ spec:
       image: docker:27-dind
       securityContext:
         privileged: true
+      # Harbor's harbor-core Service serves plain HTTP internally (TLS is
+      # disabled cluster-wide by design — see claude.md's "everything is
+      # plain HTTP" note). Docker still defaults to attempting HTTPS
+      # against any bare registry hostname regardless of whether the
+      # network path actually involves TLS anywhere — that default isn't
+      # about routing through Contour/Ingress, it's just the client's own
+      # convention. Without this flag, `docker push` hangs doing a TLS
+      # handshake against a server that's only ever spoken HTTP.
+      args:
+        - "--insecure-registry=harbor-core.harbor.svc.cluster.local"
       env:
         - name: DOCKER_TLS_CERTDIR
           value: ""