ci: split GitOps state into cloud-host-gitops repo, add Sealed Secrets, fix pipeline auth

- Workflow now pushes image tags to the separate cloud-host-gitops repo
  (no more CI loop risk) and authenticates via CI_TOKEN secret
- Fix undefined ${REGISTRY} in Kaniko jobs, add concurrency group,
  targeted tag update, and mounted kaniko-harbor-auth docker config
- Argo CD Application is now multi-source (chart from cloud-host,
  values from cloud-host-gitops)
- Remove plaintext runner token and proxy credentials from manifests;
  secrets are now SealedSecrets in the gitops repo

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/jobs/kaniko-harbor-auth.example.yaml

@@ -0,0 +1,36 @@
+# Example only — DO NOT commit real credentials.
+# The real secret is managed as a SealedSecret in the cloud-host-gitops repo
+# (sealed-secrets/kaniko-harbor-auth.yaml).
+#
+# Kaniko pushes directly to the internal registry endpoint
+# (harbor-registry.cloudhost.svc.cluster.local:5000), which bypasses harbor-core.
+# That endpoint only accepts the internal registry credential — Harbor robot
+# accounts do NOT work there (their tokens are issued by harbor-core's token
+# service). Use the harbor_registry_user credential from the harbor-core secret:
+#
+#   REG_PASS="$(kubectl -n cloudhost get secret harbor-core \
+#     -o jsonpath='{.data.REGISTRY_CREDENTIAL_PASSWORD}' | base64 -d)"
+#   kubectl -n cloudhost-builds create secret docker-registry kaniko-harbor-auth \
+#     --docker-server=harbor-registry.cloudhost.svc.cluster.local:5000 \
+#     --docker-username=harbor_registry_user \
+#     --docker-password="${REG_PASS}"
+#
+# The build-deploy workflow mounts this secret at /kaniko/.docker/config.json
+# inside every Kaniko Job. See RUNBOOK-CICD.fa.md for the full procedure.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: kaniko-harbor-auth
+  namespace: cloudhost-builds
+type: kubernetes.io/dockerconfigjson
+stringData:
+  .dockerconfigjson: |
+    {
+      "auths": {
+        "harbor-registry.cloudhost.svc.cluster.local:5000": {
+          "username": "harbor_registry_user",
+          "password": "<REGISTRY_CREDENTIAL_PASSWORD>",
+          "auth": "<base64 of username:password>"
+        }
+      }
+    }