dunn.dev/pipeline 4.7.0 `ci-iac` now carries `restic` for iac's backup-lane CI job. The Renovate preset sheds rules that restated its defaults, lands monorepo majors as one MR and closes the kmod automerge gap; the token-expiry alarm is gone. A **minor**: no template input added, removed or renamed. - **`ci-iac` image**: bundles `restic`, pinned to a GitHub release and checksum-verified, same pattern as `uv`/`sops`. Renovate-tracked via the `# renovate: datasource=github-releases depName=restic/restic` ARG comment. - **`renovate-config.json`: the "Major updates" and "Fedora VERSION bumps" rules.** Each set only `automerge: false` for majors, which is Renovate's default, and nothing earlier in the preset, its extended presets, or any repo config grants a major automerge. Resolved effective config is unchanged: majors stay human-merged unless the dev-tooling rule grants automerge. - **`renovate-token-expiry` alarm.** Expiries are a maintenance convention, never a gate: a date-keyed job manufactures a red pipeline on a calendar day with no underlying failure. The `RENOVATE_TOKEN_EXPIRES` CI variable it read is retired next. - **`renovate-config.json`: monorepo majors land as one MR.** The major-updates rule no longer resets `groupName`, so `config:recommended`'s `group:monorepos` holds: `vitest` and `@vitest/*` majors arrive together instead of as two MRs that are each red without the other. Majors stay in the human-merge lane unless the dev-tooling rule grants automerge. - **`renovate-config.json`: internal-trust rules collapsed, kmod-lane defect closed.** The internal-trusted-catalog minor/patch/digest and major rules were two duplicate-scoped rules restating what the broad automerge rules already grant by later-rule-wins order — merged into one, matching `nomograph/pipeline`'s shape. `base-zfs`/`base-zfs-nvidia` were misclassified "non-kmod" and inherited automerge from that rule (live defect: `cairn/hagstone!5` showed Automerge: Enabled on a digest bump) — added to the kmod-review rule so ABI review wins by order. Removed the now-inert per-package `minimumReleaseAge: null` on the timestamp-less-docker rule now that `minimumReleaseAgeBehaviour: timestamp-optional` (4.5.1) covers it estate-wide, restoring the 7-day gate as a self-healing fallback.