chore(renovate): give the ubuntu digest its own PR with a one-day soak

[ryanlewis]

Why

#9 has been open since 26 July and its branch was force-pushed 10 times. Only two of those were Ubuntu: the 24.04 digest moved on 4 Aug and 19 Aug. The rest were action releases moving the pins (docker/login-action twice in late July, docker/setup-buildx-action on 19 Aug), two retitles from config changes, and rebases. Because the shared config batches pin and digest updates into one group, every one of those rewrote the same branch under the reviewer.

What changes

A repo-level package rule puts the ubuntu digest update into its own group (renovate/ubuntu-digest) with minimumReleaseAge: 1 day instead of the shared 5 days.

• Separate PR. Canonical publishes a new 24.04 digest every two to four weeks. On its own, the PR only changes when Ubuntu does. The Actions pins stay in the shared group and stop moving once chore(deps): pin dependencies #9 (or its replacement) is merged, because pinned versions then flow as minor/patch with the normal soak.
• Shorter soak. The 5-day soak does apply to Docker digests (observed: digest published 4 Aug 04:05Z, branch moved 9 Aug 05:58Z; published 19 Aug 22:04Z, moved 25 Aug 14:45Z). It buys little here: this is an official image that has already been through Canonical's pipeline (the dated tag is built days before it reaches Docker Hub; the .1 respins never made it to Hub in the last year), the Dockerfile dist-upgrades on top of it, and the PR still builds in CI and gets a human merge.
• No automerge. The shared config's last rule keeps digests manual, and a merge here publishes :latest.

After merging

Renovate will close #9 and open two PRs in its place: one for the Actions pins, one for the Ubuntu digest. Both will be green; merge the pins one first so the pin churn stops.