fix(ci): use tls harbor route on non110 runner

.gitea/workflows/cd.yaml

@@ -5,6 +5,9 @@
 # 加速措施:
 #   1. Docker Layer Cache → Harbor registry cache
 #   2. 內部 Mirror → 192.168.0.110:5001 (Harbor Proxy Cache for DockerHub)
+#   3. 非 110 runner 的 Docker pull/push 走 registry.wooo.work HTTPS alias，
+#      避免要求 runner root 修改 insecure registry；K8s image pull 仍保留
+#      192.168.0.110:5000 內網 Harbor route。
 # 2026-03-29 Claude Code (ADR-039) - Retry after creating Harbor project
 
 name: CD Pipeline
@@ -30,7 +33,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  HARBOR: 192.168.0.110:5000
+  HARBOR: registry.wooo.work
   SRE_GROUP_CHAT_ID: "-1003711974679"
   # Harbor Proxy Cache (指向 DockerHub 的內部 Mirror，避免拉取限額)
   HARBOR_MIRROR: 192.168.0.110:5001
@@ -38,7 +41,7 @@ env:
   OTEL_EXPORTER_OTLP_ENDPOINT: http://192.168.0.188:24318
   OTEL_SERVICE_NAME: awoooi-cd
   OTEL_RESOURCE_ATTRIBUTES: service.version=${{ github.sha }},deployment.environment=production
-  CI_IMAGE: 192.168.0.110:5000/awoooi/ci-runner:act-22.04
+  CI_IMAGE: registry.wooo.work/awoooi/ci-runner:act-22.04
   # 2026-06-28 Codex: 110 runner pressure is an incident-grade capacity guard.
   # Do not flip this to warn-only until non-110 readiness is verified.
   HOST_WEB_BUILD_PRESSURE_WARN_ONLY: "0"