ci(renovate): drop the renovate workflow and its rebase dispatch

[BryanFRD]

Summary

Renovate moves into the cluster as a CronJob on the server node (FerrLabs/Infra#424). This removes what the org workflow needed:

• renovate.yml (the sharded org-wide sweep)
• reusable-renovate-dispatch.yml and this repo's renovate-rebase.yml (the "rebase now" trigger dispatched renovate.yml; a ticked checkbox is now handled by the next in-cluster run, every 2 h)
• the trigger-renovate job of reusable-ferrflow-release.yml, which dispatched renovate.yml after a release. The trigger-renovate input and RENOVATE_TOKEN secret stay declared, without effect, so Kit, UI and FerrVault keep a valid call until their own clean-up PRs land.
• renovate-selfcheck.yml and its fixture tests/renovate/. Its validate job stays as renovate-config.yml (strict validation on PRs touching the config, Renovate 44 like the CronJob image); the end-to-end Kellnr lookup is left to the in-cluster runs.
• default.json: descriptions point at platform/renovate/run.mjs (FerrLabs/Infra) for the global settings.

default.json stays here: the CronJob downloads it at start.

Merge order

1. FerrLabs/Infra#424, FerrVault secrets in place, one manual in-cluster run checked.
2. This PR.
3. Clean-up PRs removing renovate-rebase.yml from the calling repos.

Follow-up

FerrLabs-Cloud's CI cockpit "Run Renovate" button dispatches renovate.yml (admin_github.rs) and will stop working.

[ferrfleet]

Removal looks clean. Every caller of reusable-renovate-dispatch.yml pins it by SHA (FerrFlow, MCP, Benchmarks, FerrVault, LFSX, Changelog, Fixtures), so deleting the file from main does not break workflow resolution, and the self-check passes under Renovate 44 with --strict.

Nit: default.json still documents renovate.yml as the place the global Cargo settings live. The ferrlabs-* packageRule description says allowCustomCrateRegistries "is a global-only option set as RENOVATE_ALLOW_CUSTOM_CRATE_REGISTRIES in renovate.yml. Auth comes from the crates.ferrlabs.com hostRule there". After this PR that file is gone, and default.json is the one artefact that survives the move and gets downloaded by the CronJob, so it is where a future reader will look. Worth repointing at platform/renovate/run.mjs (FerrLabs/Infra) the way the self-check comments now do. The @ferrlabs/* rule's "Auth comes from RENOVATE_HOST_RULES env in the runner workflow" reads fine as-is.

Nit: between this merging and step 3 of the merge order, a ticked rebase checkbox in any of those seven repos runs the pinned dispatch, which ends at gh workflow run renovate.yml -R FerrLabs/.github. That is a hard error once the workflow is gone, not a skip, so those runs go red rather than quietly no-op. Acceptable for a short window, but the clean-up PRs are the seven repos above, not only the three listed for trigger-renovate.

[ferrfleet]

On a676379 (self-check + fixture removal) only.

Blocking: dropping renovate-selfcheck.yml wholesale also drops the validate job, which is the only thing in this repo that ever checked default.json, renovate.json and snippets/renovate.json parse. lint.yml only bash -ns run blocks; nothing else touches them. default.json stays here and the CronJob downloads it at start from main unpinned, so after this merges a bad edit is deployed org-wide with no gate, and "the in-cluster runs show it in their own logs" is detection after the fact. That is the shape of #205: a WARN, no non-zero exit, a month of no ferrlabs-* PRs.

The kellnr-lookup job genuinely belongs in the cluster now: it needs the sweep's env and secrets, and reproducing them on a hosted runner was always the weak part. validate needs neither. Suggest keeping just that job, retargeted:

name: Renovate config

on:
  pull_request:
    paths:
      - "default.json"
      - "renovate.json"
      - "snippets/renovate.json"
      - ".github/workflows/renovate-config.yml"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  validate:
    name: Validate config (strict)
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      # Keep in step with the Renovate image the CronJob runs
      # (FerrLabs/Infra, platform/renovate).
      RENOVATE_VERSION: "44"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "24"
      - run: |
          npx --yes --package "renovate@${RENOVATE_VERSION}" \
            renovate-config-validator --strict \
            default.json renovate.json snippets/renovate.json

The schedule and the workflow_dispatch are not worth carrying over: with the sweep gone, a PR-path trigger covers every way these three files change. RENOVATE_VERSION should now track the CronJob's image tag rather than renovatebot/github-action's bundled version, which is what the old comment pinned it to.

If you would rather the validation live next to the CronJob in FerrLabs/Infra, that also closes it, but it moves the check away from the repo where the files are edited, so a bad default.json would only fail after merge. I would keep it here.

[BryanFRD]

Addressed in 36a75e7: the validate job is back as renovate-config.yml (PR-path trigger, Renovate 44 to match the CronJob image, --strict passes on the three files), and both default.json descriptions now point at platform/renovate/run.mjs in FerrLabs/Infra. On the rebase window: the 29 clean-up PRs remove renovate-rebase.yml from every calling repo, not only the three that pass trigger-renovate.

[ferrfleet]

Fixed in 36a75e7.

The blocking finding is closed: renovate-config.yml restores strict validation of default.json, renovate.json and snippets/renovate.json on every PR that touches them, pinned to the CronJob's Renovate major (44) with the image path named in the comment. The check is green on this head. Same commit also repoints both default.json descriptions at platform/renovate/run.mjs, which closes the earlier nit.

No references to the removed workflows or tests/renovate/ remain in the repo, and the job name (Validate config (strict)) is unchanged, so a branch rule requiring it by name still resolves.