feat: migrate CI/CD from GHCR to local Harbor registry

- Makefile: GHCR -> registry.celestium.life/stonks-oracle
- GitHub Actions: login to Harbor, use HARBOR_PASSWORD secret
- infra/k8s/*.yaml: all image refs -> registry.celestium.life
- inttest pipeline: remove GHCR pull secret (local registry, no auth)
- Steering docs: update registry/git endpoints

Makefile

@@ -1,6 +1,6 @@
 REPO_OWNER := celesrenata
 REPO_NAME := stonks-oracle
-GHCR := ghcr.io/$(REPO_OWNER)/$(REPO_NAME)
+REGISTRY := registry.celestium.life/stonks-oracle
 SHA := $(shell git rev-parse --short HEAD 2>/dev/null || echo "dev")
 
 SERVICES := scheduler symbol-registry ingestion parser extractor aggregation recommendation risk broker-adapter lake-publisher query-api
@@ -12,7 +12,7 @@ help:
 	@echo "  lint       - Run ruff linter"
 	@echo "  test       - Run pytest"
 	@echo "  build      - Build all service images locally"
-	@echo "  push       - Push all images to GHCR"
+	@echo "  push       - Push all images to registry"
 	@echo "  deploy     - Apply K8s manifests"
 	@echo "  clean      - Remove local images"
 
@@ -40,26 +40,26 @@ build:
 		echo "Building $$svc ($$cmd)..."; \
 		docker build \
 			--build-arg "SERVICE_CMD=$$cmd" \
-			-t $(GHCR)/$$svc:$(SHA) \
-			-t $(GHCR)/$$svc:latest \
+			-t $(REGISTRY)/$$svc:$(SHA) \
+			-t $(REGISTRY)/$$svc:latest \
 			-f docker/Dockerfile . || exit 1; \
 	done
 	@echo "Building dashboard..."
 	docker build \
-		-t $(GHCR)/dashboard:$(SHA) \
-		-t $(GHCR)/dashboard:latest \
+		-t $(REGISTRY)/dashboard:$(SHA) \
+		-t $(REGISTRY)/dashboard:latest \
 		-f frontend/Dockerfile frontend/ || exit 1
 	@echo "Building superset..."
 	docker build \
-		-t $(GHCR)/superset:$(SHA) \
-		-t $(GHCR)/superset:latest \
+		-t $(REGISTRY)/superset:$(SHA) \
+		-t $(REGISTRY)/superset:latest \
 		-f docker/Dockerfile.superset docker/ || exit 1
 
 push:
 	@for svc in $(SERVICES); do \
 		echo "Pushing $$svc..."; \
-		docker push $(GHCR)/$$svc:$(SHA); \
-		docker push $(GHCR)/$$svc:latest; \
+		docker push $(REGISTRY)/$$svc:$(SHA); \
+		docker push $(REGISTRY)/$$svc:latest; \
 	done
 
 deploy:
@@ -70,5 +70,5 @@ deploy:
 
 clean:
 	@for svc in $(SERVICES); do \
-		docker rmi $(GHCR)/$$svc:$(SHA) $(GHCR)/$$svc:latest 2>/dev/null || true; \
+		docker rmi $(REGISTRY)/$$svc:$(SHA) $(REGISTRY)/$$svc:latest 2>/dev/null || true; \
 	done