Pull D&D agent images from Harbor instead of building on the runner

The agent and post-processor were built on the runner from rsync'd source.
That tied the deploy to a path on one workstation, made the runner a build
host, and left no way to tell which commit a running image came from.

Now they are pulled like the table server already was, so all four D&D
services follow one pattern. Registry settings are hoisted out of the
table-specific block and shared, and the Harbor login is no longer gated on
dnd_table_enabled - with three services pulling from Harbor, gating the login
on the table would silently skip it and fail the pull.

Images are built and pushed from the dnd-agent repo with tools/build-push.sh;
deploying is now a version bump here.