Make the registry hostname configurable and drop the CA mount

buildDocker.groovy hardcoded harbor.35.238.248.203.nip.io as the push
target, so the registry could not move without editing this shared library
and every consumer moving in the same commit. It now reads
config.harbor_registry, whose default lives in homelabPipeline.groovy
beside harbor_project and every other key.

The stage errors rather than defaulting when the value is missing. Carrying
a second copy of the literal would leave two defaults free to disagree, and
an unset value would otherwise build an image named "null/<project>/<repo>"
— which docker accepts as a hostname and then fails to resolve, pointing
nowhere near the cause.

The dind pod no longer mounts the registry CA. That mount existed because
the registry was a nip.io name, which no public CA will issue for, so
cert-manager signed Harbor from a private CA; the node pool was told to
trust it for pulls, but a push comes from dockerd inside the build pod,
which has its own trust store. harbor.infra.deployshed.com carries a Let's
Encrypt certificate that both already trust, so the mount, its volume and
the whole arrangement go away rather than being repointed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

resources/org/homelab/dind-pod.yaml

@@ -15,34 +15,33 @@ spec:
       image: docker:27-dind
       securityContext:
         privileged: true
-      # No --insecure-registry, unlike the homelab: Harbor here serves a real
-      # certificate, issued by cert-manager from the private CA that the node
-      # pool was told to trust when it was created.
+      # No --insecure-registry and no mounted CA: Harbor is reached at
+      # harbor.infra.deployshed.com, which carries a publicly trusted Let's
+      # Encrypt certificate, so dockerd's own trust store already accepts it
+      # with nothing configured.
       #
-      # That node trust covers image PULLS, which containerd performs on the
-      # node. This push is a different client — dockerd, inside this pod,
-      # with its own trust store and no knowledge of what the node trusts —
-      # so it needs the CA mounted itself. dockerd looks it up at
-      # /etc/docker/certs.d/<registry host>/ca.crt, and the directory name
-      # must be the registry hostname exactly; anything else is silently
-      # ignored, and the push then fails TLS verification while a pull of the
-      # very same image works.
+      # This previously mounted the private registry CA here, because the
+      # registry was a nip.io name that no public CA can issue for (nip.io is
+      # not on the public suffix list, and every *.nip.io certificate shares
+      # one rate limit), so cert-manager signed it from a private CA instead.
+      # A pull was fine — the node pool was told to trust that CA and
+      # containerd performs pulls — but a push is a different client with its
+      # own trust store, which is why dockerd needed the CA at
+      # /etc/docker/certs.d/<registry host>/ca.crt. Moving to a real domain
+      # removes the whole arrangement rather than repointing it.
       #
-      # The registry hostname (rather than harbor-core.harbor.svc.cluster.local)
-      # carries over unchanged from the homelab, for a reason that still
-      # holds: cluster DNS resolves from this pod but not from the node's
-      # containerd doing the real Deployment pull, and Docker matches both
-      # stored credentials and trust by exact hostname — so push and pull
-      # have to name the registry identically.
+      # The registry is still named by its ingress hostname rather than
+      # harbor-core.harbor.svc.cluster.local, for a reason that still holds:
+      # cluster DNS resolves from this pod but not from the node's containerd
+      # doing the real Deployment pull, and Docker matches both stored
+      # credentials and trust by exact hostname — so push and pull have to
+      # name the registry identically.
       env:
         - name: DOCKER_TLS_CERTDIR
           value: ""
       volumeMounts:
         - name: docker-graph-storage
           mountPath: /var/lib/docker
-        - name: registry-ca
-          mountPath: /etc/docker/certs.d/harbor.35.238.248.203.nip.io
-          readOnly: true
     - name: docker-cli
       # Custom image, built and pushed by hand from devops-base-images-gcp
       # (build-tools.Dockerfile there) — bakes in git/yq/bash/python3 with
@@ -55,7 +54,7 @@ spec:
       #
       # Versioned tag, never :latest — rebuilding the tools image must not
       # roll out until this pin is bumped deliberately.
-      image: harbor.35.238.248.203.nip.io/base-images/build-tools:1
+      image: harbor.infra.deployshed.com/base-images/build-tools:1
       command: ["cat"]
       tty: true
       env:
@@ -92,13 +91,6 @@ spec:
   volumes:
     - name: docker-graph-storage
       emptyDir: {}
-    - name: registry-ca
-      configMap:
-        # Published by devops-infra-argo-config-gcp (extra-manifests). The
-        # CA's public certificate only — its private key never leaves
-        # Terraform state and cert-manager, which is why this is a ConfigMap
-        # rather than a Secret.
-        name: registry-ca
     - name: docker-config
       secret:
         secretName: harbor-robot-dockerconfig