ci(images): pass Harbor secrets as env vars so robot $ is not expanded (DEV-617)

Harbor robot usernames are of the form `robot$basicstack+forgejo-ci`.
Forgejo Actions substitutes `${{ secrets.HARBOR_USERNAME }}` into the
`run:` script before bash runs it, so `set -u` sees the resulting
`robot$basicstack+forgejo-ci` and dies with "basicstack: parameter
not set" trying to expand `$basicstack`. Pass the Harbor credentials
as env vars on the step; bash then reads them from the environment as
plain strings instead of parsing them for parameter expansion.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.forgejo/workflows/build-images.yml

@@ -82,10 +82,18 @@ jobs:
 
       - name: Login to Harbor (push jobs only)
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        # Harbor robot usernames contain `$` (e.g. `robot$basicstack+ci`),
+        # so inlining `${{ secrets.HARBOR_USERNAME }}` directly in the
+        # `run:` script makes bash expand `$basicstack` (and die under
+        # `set -u`). Pass the secrets as env vars so the shell only sees
+        # them as plain strings.
+        env:
+          HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
+          HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
         run: |
           set -eu
-          echo "${{ secrets.HARBOR_PASSWORD }}" | \
-            docker login "${REGISTRY}" --username "${{ secrets.HARBOR_USERNAME }}" --password-stdin
+          echo "${HARBOR_PASSWORD}" | \
+            docker login "${REGISTRY}" --username "${HARBOR_USERNAME}" --password-stdin
 
       - name: Push image (main only)
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'