feat: migrate CI/CD from GHCR to local Harbor registry

- Makefile: GHCR -> registry.celestium.life/stonks-oracle
- GitHub Actions: login to Harbor, use HARBOR_PASSWORD secret
- infra/k8s/*.yaml: all image refs -> registry.celestium.life
- inttest pipeline: remove GHCR pull secret (local registry, no auth)
- Steering docs: update registry/git endpoints

infra/inttest/run_pipeline.sh

@@ -236,15 +236,12 @@ if ! kubectl create namespace "$NAMESPACE"; then
 fi
 
 # ── Create GHCR image pull secret (if token available) ───────────────────────
+# NOTE: Images now served from Harbor at registry.celestium.life (no auth needed for pulls)
+# This block is kept for backward compatibility but is no longer required
 if [ -n "${GHCR_TOKEN:-}" ]; then
-  log "Creating ghcr-credentials secret ..."
-  kubectl create secret docker-registry ghcr-credentials \
-    --docker-server=ghcr.io \
-    --docker-username=celesrenata \
-    --docker-password="$GHCR_TOKEN" \
-    -n "$NAMESPACE" || true
+  log "GHCR_TOKEN set but images are on local Harbor — skipping GHCR secret"
 else
-  log "GHCR_TOKEN not set — skipping image pull secret (images must be pullable without auth)"
+  log "Images served from registry.celestium.life (no pull secret needed)"
 fi
 
 # ── Create Docker Hub pull secret (avoid rate limits) ────────────────────────