Replace harbor.fireflylab.local (external DNS, not resolvable from pods)
with harbor-core.harbor.svc.cluster.local (internal ClusterIP, always resolvable).
DinD insecure-registry flag allows HTTP to the internal service.
values.yaml image.repository stays as harbor.fireflylab.local so kubelet
pulls via the external hostname (same image, different access path).
K8s pod is ephemeral — workspace dies with pod. deleteDir/cleanWs
not needed and fails on node_modules permission errors.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>