ci(deploy): migrate build to docker:28.4.0-dind + GitLab container registry

deploy/k8s/base/deployment.yaml

@@ -23,20 +23,18 @@ spec:
         fsGroup: 1001
         runAsUser: 1001
         runAsGroup: 1001
-      # Confirmed 2026-08-05: ghcr.io/brvncde-dotcom/vncmail-plus-dev IS public
-      # (anonymous token pull succeeded) — no imagePullSecrets needed. This is
-      # deploy/k8s/README.md's own documented alternative to creating a
-      # ghcr-pull secret. Removed rather than left referencing a
-      # not-yet-created secret, which would otherwise block every pod from
-      # starting regardless of the image being public (kubelet fails to
-      # resolve a missing imagePullSecrets entry before it ever gets to
-      # deciding whether auth was actually required).
+      # The GitLab container registry is private by default. Nodes need a
+      # docker-registry secret named `gitlab-registry` in the target namespace.
+      # Create it once per environment during first-time setup
+      # (see deploy/k8s/README.md §3a).
+      imagePullSecrets:
+        - name: gitlab-registry
       containers:
         - name: vncmail-plus
-          # Default/legacy value — CI overrides the image per-deploy via
-          # `kustomize edit set image`, so what's committed here never goes
-          # stale. For a one-off manual apply, pin a digest instead of :latest.
-          image: ghcr.io/brvncde-dotcom/vncmail-plus-dev:latest
+          # Generic placeholder — the real image name + tag are injected by the
+          # image-tag kustomize Component on every deploy (see
+          # overlays/*/image-tag/kustomization.yaml, rewritten by CI).
+          image: vncmail-plus:latest
           imagePullPolicy: Always
           ports:
             - containerPort: 3000