fix(build): default Kaniko and init images to Harbor via Helm values

User-app builds no longer pull gcr.io/docker.io directly when build.images
is configured in values.yaml, fixing ImagePullBackOff on clusters without
upstream registry access.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-platform/values-production.example.yaml

@@ -22,6 +22,14 @@ images:
     tag: "1.0.0"
     pullPolicy: Always
 
+# Build job images — override for clusters without Harbor proxy-cache.
+build:
+  images:
+    kaniko: registry.example.com/proxy-gcr/kaniko-project/executor:v1.23.2
+    alpine: registry.example.com/proxy-dockerhub/library/alpine:3.19
+    alpineGit: registry.example.com/proxy-dockerhub/alpine/git:2.43.0
+  baseImageRegistry: registry.example.com/proxy-dockerhub/library
+
 postgres:
   password: "CHANGE_ME_STRONG_POSTGRES_PASSWORD"
   # Pull secret for the mirrored postgres image
@@ -58,8 +66,6 @@ backend:
     PLATFORM_DOMAIN: apps.example.com
     REGISTRY_URL: registry.cloudhost-builds.svc.cluster.local:5000
     REGISTRY_PULL_URL: registry.cloudhost-builds.svc.cluster.local:5000
-    # Mirror prefix for base images in generated Dockerfiles + managed services
-    BASE_IMAGE_REGISTRY: registry.example.com/mirror
     # Elastic log-stack credentials (must match the logging namespace Secret)
     ELASTIC_PASSWORD: "CHANGE_ME_ELASTIC_PASSWORD"
     FLUENTBIT_PASSWORD: "CHANGE_ME_FLUENTBIT_PASSWORD"