v5.7.0
Two independent hardening tracks: CI-resilience fixes for the retry/timeout
gap that let a hung job burn its full ceiling with zero retry, and Renovate
config hardening for the estate's self-hosted setup (Fedora rawhide
exposure, an undetected image ref, `mise lock` blocked estate-wide, and a
`force`-vs-schedule interaction that was double-firing lockFileMaintenance).
### Added
- **Renovate: Fedora image-tag ceiling + major-version review gate.** The
estate preset had zero Fedora-specific rules, so quay.io's
numerically-newer rawhide tags looked like an ordinary major bump --
`nomograph/reference` (pinned `quay.io/fedora/fedora:42`) was queuing a
bump straight to v45 = rawhide. Ported three rules verbatim from
`dunn.dev/pipeline`'s preset (re-read from source, not memory), scoped to
`quay.io/fedora/fedora`, `-bootc`, `-minimal`, `-toolbox` and their
`registry.fedoraproject.org` equivalents: an `allowedVersions: "<=44"`
cap (bump at each Fedora GA -- this is a maintenance point, source of
truth https://docs.fedoraproject.org/en-US/releases/); a
`matchUpdateTypes: major` rule keeping major bumps `automerge: false` for
human review (split from the cap into its own rule so it doesn't block
digest automerge -- Renovate forbids `allowedVersions` +
`matchUpdateTypes` together in one rule); and `pinDigests: false` (quay.io
GCs Fedora digests within hours, so a captured pin loses the race before
the branch can even merge -- confirmed by two prior main breaks on GC'd
digests and weeks of Errored dashboard branches on `cairn/base`,
`cairn/pipeline`, `immutable/pipeline`, `immutable/basef`).
- **Renovate: `${VAR}`-prefixed image custom manager.** No built-in manager
sees a `${NOMOGRAPH_REGISTRY}/tree-sitter:v4.1.4`-shaped `image:` line --
`tree-sitter-sysml`'s Dependency Dashboard listed only its `component:`
include, never this image. New regex custom manager targets
`.gitlab-ci.yml`, `datasource: gitlab-tags`, `packageName` fixed to
`nomograph/pipeline` (every image under that registry root is built and
re-tagged in lockstep with a `nomograph/pipeline` release, confirmed
against this repo's own container-build job), `versioningTemplate:
"loose"` (mandatory -- the default strict semver silently drops
non-3-part tags like `v4.1.4`). Verified against the real
`tree-sitter-sysml` file and also matches `nomograph/extension`'s
`${NOMOGRAPH_REGISTRY}/rust-cli:v5.4.0`.
### Changed
- **All 18 job-level `retry:` bloc