Stabilize CI Kaniko tag and keep Harbor free of egress proxy.

Use the seeded kaniko v1.27.6-debug image, retry npm ci, and push via harbor-core without HTTP_PROXY so Harbor UI metadata and blob uploads keep working.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/build-deploy.yaml

@@ -102,7 +102,10 @@ jobs:
                         apk add --no-cache git &&
                         git clone --depth=1 --branch main http://oauth2:${GITEA_TOKEN}@${GITEA_HOST}/${REPO_PATH} /workspace &&
                         cd /workspace/backend &&
-                        npm ci --legacy-peer-deps &&
+                        npm config set fetch-retries 5 &&
+                        npm config set fetch-retry-mintimeout 20000 &&
+                        npm config set fetch-retry-maxtimeout 120000 &&
+                        (npm ci --legacy-peer-deps || (echo 'npm ci failed, retrying...' && sleep 5 && npm ci --legacy-peer-deps) || (echo 'npm ci failed again, retrying...' && sleep 10 && npm ci --legacy-peer-deps)) &&
                         npm run test -- --ci --runInBand
                     resources:
                       requests: { cpu: 500m, memory: 1Gi }
@@ -159,7 +162,7 @@ jobs:
                         mountPath: /workspace
                 containers:
                   - name: kaniko
-                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.23.2
+                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
                     # Base image (node:24-alpine) is seeded in Harbor abrban/ — avoids
                     # flaky direct pulls from docker.io through the egress proxy.
                     envFrom:
@@ -224,7 +227,7 @@ jobs:
                         mountPath: /workspace
                 containers:
                   - name: kaniko
-                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.23.2
+                    image: ${PULL_REGISTRY}/${PROJECT}/kaniko-executor:v1.27.6-debug
                     envFrom:
                       - secretRef:
                           name: registry-egress-proxy