Fix Kaniko registry auth and push target for Harbor builds.

Mount docker config as config.json (Kaniko requirement), push via
harbor-registry internal URL, and wire harbor_registry_user credentials
in Helm/GitOps values.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/values.yaml

@@ -28,6 +28,12 @@ images:
     tag: "1.0.0"
     pullPolicy: IfNotPresent
 
+# Kaniko push credentials — harbor_registry_user for harbor-registry:5000 (Harbor production).
+registry:
+  credentialsSecret: ""
+  credentialsPasswordKey: REGISTRY_CREDENTIAL_PASSWORD
+  username: harbor_registry_user
+
 # Kaniko job images — defaults pull from Harbor proxy-cache.
 # Override any line for a different registry/tag.
 build: