[venkatamutyala]

Why

The render-on-renovate job re-renders crds/, charts/*/crds/ and the Chart.yaml pins, then commits them, but only on renovate/* branches. On every other PR, verify fails with "crds/ or Chart.yaml pins are stale" until someone runs hack/render.sh by hand. The immediate motivation is syncing feat/otel-20260902 (#68) with main: after this change, only kustomization.yaml needs editing by hand.

What

• ci.yaml: removed the renovate/ condition, so the job now runs on every PR. Fork PRs already need maintainer approval before any workflow runs (all_external_contributors) and get no secrets, so on a fork PR the job would at worst fail without pushing anything.
• ci.yaml: the bot's commit message changes to chore: re-render crds/ and Chart.yaml pins. It no longer mentions renovate, and it still passes the conventional-commit check.
• README.md and the renovate.json description say the job runs on any same-repo PR, not just renovate branches.

Nothing else changes: the job name, the steps and the App token are all the same.

Worth knowing

• If the bot pushes after a PR is approved, that approval is dismissed (the ruleset has dismiss_stale_reviews_on_push), just like any other push.
• The job now also runs on release-please PRs. Those only change the version, CHANGELOG and release manifest on top of an already-rendered main, so render finds no drift and nothing gets pushed.
• On this PR the job should run, find no drift, and push nothing.

🤖 Generated with Claude Code