fix(harbor): mirror to external Harbor endpoint (valid TLS)

harbor-core internally advertises an HTTPS token realm, so skopeo could not push
over HTTP. Push to registry.bstein.dev (valid cert, the path kaniko already
uses); the image lands in the same 'mirror' project and stays internally pullable.

services/harbor/hermes-agent-base-mirror-job.yaml

@@ -106,16 +106,15 @@ spec:
             - |
               set -eu
               src="docker://nousresearch/hermes-agent@sha256:9c841866021c54c4596849f6135717e8a4d52ba510b7f52c50aef1de1a283973"
-              dst="docker://harbor-core.harbor.svc.cluster.local:80/mirror/hermes-agent@sha256:9c841866021c54c4596849f6135717e8a4d52ba510b7f52c50aef1de1a283973"
+              # Push to the EXTERNAL Harbor endpoint (valid TLS) — the same path
+              # kaniko already publishes to — to avoid harbor-core's internal
+              # HTTP/token-realm quirks. The image lands in the same Harbor
+              # 'mirror' project, so kaniko still pulls it internally via harbor-core.
+              dst="docker://registry.bstein.dev/mirror/hermes-agent@sha256:9c841866021c54c4596849f6135717e8a4d52ba510b7f52c50aef1de1a283973"
               pw="$(cat /vault/secrets/harbor-admin-password)"
-              # harbor-core serves the registry + token service over plain HTTP on
-              # :80; mark it insecure so skopeo (and the token request it derives
-              # from the auth challenge) use HTTP instead of defaulting to HTTPS.
-              printf '[[registry]]\nlocation = "harbor-core.harbor.svc.cluster.local:80"\ninsecure = true\n' > /tmp/registries.conf
-              export CONTAINERS_REGISTRIES_CONF=/tmp/registries.conf
               exec skopeo copy --all \
                 --src-tls-verify=true \
-                --dest-tls-verify=false \
+                --dest-tls-verify=true \
                 --dest-creds "admin:${pw}" \
                 "${src}" "${dst}"
           env: