Schedule workloads to start only after harbor and other prerequisites are available

On full cluster reboot, all workloads start simultaneously but most can't pull images until Harbor (and other prereqs) is/are up, unnecessarily overloading our nodes making those prereqs start up even slower.

I want to try to use [kubernetes-sigs/node-readiness-controller](https://github.com/kubernetes-sigs/node-readiness-controller) to taint nodes on boot and release them in tiers as prerequisites become healthy:

1. **required** — Harbor + infra (tolerates all taints, starts immediately)
2. **priority** — starts once Harbor is healthy (could be useful in a 'low-resources' situation so we only start absolute essential services like the IA website and Alexia, but not lower-priority ones)
3. **other** — starts once priority workloads are healthy

- We can use the `bootstrap-only` enforcement mode to only apply these gates on boot, and not re-taint nodes later.
- As part of the system, we need to deploy a condition-reporter DaemonSet to set node conditions from health checks (Harbor `/health`, priority pods `Ready`).
- We also need to set tolerations on the required / priority workloads so that they are allowed to start even when the nodes are tainted.

https://node-readiness-controller.sigs.k8s.io/

Start with the node-readiness-controller documentation and its bootstrap-only enforcement mode. Map the required, priority, and other workloads, then review the condition-reporter DaemonSet, Harbor /health checks, priority pod readiness, and required tolerations. Done means prerequisites gate workload tiers correctly during boot without later re-tainting nodes.

Written by the indexing model from the issue text.