K19 AFAIK should work. @mmodell and I fiddled a bit with K18 which is when we discovered T225308: Users with a different name in the cn field compared to uid field cannot use http auth (phabricator is one such user phab vs phabricator).
I think what needs to happen is we need to login to gerrit as phab; generate a new http token via https://gerrit.wikimedia.org/r/#/settings/http-password ; and update K18; however, I don't have the phab creds (they're not in the Release-Engineering-Team password store).
Yay. SSH did work. I've updated https://phabricator.wikimedia.org/source/ores/uri/view/20533/ to use ssh://email@example.com:29418/scoring/ores/ores with K19 credential; and deactivated https://phabricator.wikimedia.org/source/ores/uri/view/22873/ so it stops spamming login errors in the gerrit logs. Once K18 gets updated we can either switch back to HTTP mirroring, or leave it to mirror via SSH as it's now :-)