Push to apps-registry, the project that exists on this Harbor

The homelab pushes to a project called "homelab"; this cluster's is
apps-registry. Harbor rejects a push to a missing project with
"unauthorized: project homelab not found" — the word unauthorized sends
you looking at the robot account, when the credentials were never the
problem.

Only the harbor_project default changes. The com/homelab and org/homelab
paths in this repo are the library's own package and resource paths and
have nothing to do with the registry; renaming those would break the
library.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N

README.md

@@ -46,7 +46,7 @@ in after checkout; repo-committed values win over the Jenkinsfile call).
 |---|---|---|
 | `service_name` | `repo_name` | Second path segment under `devops-helm-charts/values/` |
 | `argo_app_name` | `repo_name` | Must match the ArgoCD Application's `metadata.name` |
-| `harbor_project` | `homelab` | Must be an existing, public Harbor project |
+| `harbor_project` | `apps-registry` | Must already exist in Harbor, and be public unless you also wire an `imagePullSecret` — the app values assume anonymous pull. A push to a missing project fails as `unauthorized: project <name> not found` |
 | `helm_repo_url` | `devops-helm-charts-gcp`, over cluster DNS | `http://gitea-http.gitea.svc.cluster.local:3000/gitadmin/…` — pod-to-pod, so it never leaves the cluster and comes back through the ingress |
 | `image_tag_yq_path` | `.deployment.image.tag` | **Override this if the app's chart isn't `1.0.0`** — e.g. `sts-2.0.0` uses `.podtemplate.image.tag` instead. Getting this wrong doesn't fail loudly: `yq -i` creates the path if missing rather than erroring, silently leaving the real field un-bumped. |
 | `dockerBuildVersion` | none | Only read when the repo has **no Dockerfile of its own** — picks a fallback template (see below). No default; either ship a Dockerfile or set this. |

vars/homelabPipeline.groovy

@@ -23,7 +23,12 @@
 def call(Map config) {
     config.service_name      = config.service_name      ?: config.repo_name
     config.argo_app_name     = config.argo_app_name      ?: config.repo_name
-    config.harbor_project    = config.harbor_project     ?: 'homelab'
+    // The Harbor project images are pushed to. Named apps-registry on this
+    // cluster, not the homelab's "homelab" — the project has to already
+    // exist, and Harbor rejects a push to a missing one with
+    // "unauthorized: project <name> not found", which reads like a
+    // credentials problem rather than a missing project.
+    config.harbor_project    = config.harbor_project     ?: 'apps-registry'
     // Cluster DNS, not the ingress hostname: this clone happens from a build
     // pod, so it is pod-to-pod traffic and has no business leaving the
     // cluster and coming back in through Contour.