fix: reconcile inert .github Renovate configuration

[Danathar]

Problem

projectbluefin/common contains two Renovate configuration files:

• renovate.json at the repository root
• .github/renovate.json5

Renovate checks the root file first and stops after finding it. The .github/renovate.json5 file is not loaded.

This creates an active maintenance gap:

1. The root configuration enables the built-in dockerfile manager, which tracks the normal Dockerfile dependencies, including the alpine base-image digest.
2. The inactive .github/renovate.json5 contains the only custom.regex managers for:
   • the wallpaper COPY --from=ghcr.io/ublue-os/bluefin-wallpapers-gnome digest in Containerfile;
   • BONEDIGGER_VERSION in system_files/bluefin/usr/share/ublue-os/just/60-bonedigger.just.
3. Those two values are not currently tracked by Renovate. A live Renovate run reported dockerfile (1 file / 9 dependencies), github-actions (11 / 40), and renovate-config; it reported no custom.regex manager. If .github/renovate.json5 were active, its enabledManagers: ["github-actions", "custom.regex"] would also prevent the observed dockerfile manager from running.
4. The inactive file also contains a GitHub Actions minor/patch automerge rule. If the root config were removed or config selection changed, that rule could silently become active again.

Relation to existing work

#433 was closed as completed after adding a custom-manager remediation for the Containerfile digest gap. That remediation lives in the inactive .github/renovate.json5, so it never took effect for the wallpaper digest. Treat #433 as a candidate for reopening or explicitly superseding after this issue lands.

#1074 and draft #1146 address only the GitHub Actions human-review gate. They must not absorb this unrelated configuration repair.

#1103 is the broader RFC proposing an organization-wide audit. This issue owns the concrete, already-diagnosed common repair.

Required outcome

In a separate PR:

• Move the required custom managers into the active configuration, or otherwise select one configuration file deliberately.
• Remove or reconcile the inactive duplicate so it cannot re-enable stale policy later.
• Preserve the wallpaper and Bonedigger tracking behavior.
• Correct docs/skills/ci-tooling/references/renovate-and-tools.md to match the active configuration.
• Add focused tests for the chosen configuration layout and manager coverage.
• Re-evaluate the first-party GitHub Actions automerge policy deliberately; do not reintroduce it by accident.

[Danathar]

Closing as covered by the broader blind-spot audit in #1103. The concrete common findings and live manager evidence are recorded there; #1074 remains narrowly scoped to the GitHub Actions review gate.

[Danathar]

Reopened: this is not a duplicate of #1103. #1103 is an RFC for an organization-wide audit; #1147 owns the already-confirmed common defect and its repair. The remediation associated with closed #433 was added to the inactive .github/renovate.json5, so the wallpaper digest remains untracked. #1074 and draft #1146 remain limited to the GitHub Actions review gate.