fix(build): default Kaniko and init images to Harbor via Helm values

User-app builds no longer pull gcr.io/docker.io directly when build.images
is configured in values.yaml, fixing ImagePullBackOff on clusters without
upstream registry access.

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/platform/values-abrban.example.yaml

@@ -28,6 +28,14 @@ images:
     tag: "1.0.0"   # ← CI overwrites on each deploy
     pullPolicy: IfNotPresent
 
+# Kaniko job images — Harbor proxy-cache (first pull is slow, no manual seed needed).
+build:
+  images:
+    kaniko: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2
+    alpine: registry.abrban.com/proxy-dockerhub/library/alpine:3.19
+    alpineGit: registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0
+  baseImageRegistry: registry.abrban.com/proxy-dockerhub/library
+
 postgres:
   enabled: true
   database: cloudhost
@@ -98,8 +106,6 @@ backend:
     PLATFORM_STORAGE_PROVISIONER: rancher.io/local-path
     ELASTICSEARCH_HOST: elasticsearch.logging.svc.cluster.local
     ELASTICSEARCH_AUTO_PORT_FORWARD: "false"
-    # Mirror prefix for user-app Dockerfiles and managed DB/Redis/RabbitMQ charts
-    BASE_IMAGE_REGISTRY: registry.abrban.com/proxy-dockerhub/library
     # Must match elasticsearch-credentials Secret in logging namespace (not in Helm chart)
     ELASTIC_PASSWORD: "CHANGE_VIA_SEALEDSECRET_OR_KUBECTL"
     FLUENTBIT_PASSWORD: "CHANGE_VIA_SEALEDSECRET_OR_KUBECTL"