Harbor: test the image supply chain end to end

Push a representative container image to Harbor, scan it, apply project permissions, and pull it from the deployment environment. Check how tags and immutable digests are handled, how a vulnerable image is surfaced, and whether an unauthorized user is blocked.

Then rehearse registry backup, restore, and a cleanup policy without deleting a needed release. A private registry is part of deployment infrastructure; its value depends on reliable access, traceability, and recovery, not just storing layers.