[AZ-203] Parameterize registry host via REGISTRY_HOST secret

Pipeline reads $REGISTRY_HOST from the Woodpecker global secret
'registry_host' instead of hardcoding 'localhost:5000'. The full
host:port lives in the secret, so Harbor migration (AZ-205) becomes
one secret edit rather than editing every submodule pipeline.

Made-with: Cursor

.woodpecker/build-arm.yml

@@ -8,11 +8,14 @@ labels:
 steps:
   - name: build-push
     image: docker
+    environment:
+      REGISTRY_HOST:
+        from_secret: registry_host
     commands:
       - if [ "$CI_COMMIT_BRANCH" = "main" ]; then export TAG=arm; else export TAG=${CI_COMMIT_BRANCH}-arm; fi
-      - docker build -f Dockerfile -t localhost:5000/loader:$TAG .
-      - docker push localhost:5000/loader:$TAG
-      - docker save localhost:5000/loader:$TAG -o loader-image.tar
+      - docker build -f Dockerfile -t $REGISTRY_HOST/loader:$TAG .
+      - docker push $REGISTRY_HOST/loader:$TAG
+      - docker save $REGISTRY_HOST/loader:$TAG -o loader-image.tar
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
   - name: publish-artifact