Enable Renovate automerge, Docker updates and Zizmor CI

[rb3ckers]

Use the shared Go, Docker and automerge presets with scheduled Renovate and approval App workflows. Pin BCI bases to release tags and digests, and track CI builder digests and the runtime base metadata reference. Builder digests match the existing commit-tagged images.

Add the standard SHA-pinned Zizmor action and require it for publication and CI success.

Uses StackVista/renovate-config#29. Merge and apply StackVista/pulumi-infra#413 first for both Apps’ credentials and access; the updater App also needs Dependabot alerts read access. Keep Dependabot security updates disabled.

Go-only dry-run: 9 candidate PR groups, including 21 routine minor modules grouped into 2 PRs. A security-only module-minor rule would reduce this to 7 groups and preserve both OSV security candidates. That rule is not included. Strict Go filtering may understate the queue; no update PRs were created.

Tracking: StackVista/renovate-config#22

Validation: Renovate schema, image extraction, CI gates and authenticated Zizmor passed. BCI pins support both architectures. Both dry-run configurations completed successfully.

[LouisParkin]

Verdict: looks good (revised; no blocking findings).

High — Standards: $/ in .github/workflows/ci.yml:372 is not a valid local workflow reference. Retracted: this was wrong. $/ resolves the same-repo workflow. stackstate-agent#547 calls $/.github/workflows/godeps-cache.yml and those jobs ran successfully, and the CI run on d51bcfc parsed this file and passed.

Other checks passed: all commits are signed, action SHAs match their tag comments, no YAML commentary was added, Zizmor gates publication and ci-success, and the tracker is linked by cross-repo URL.

[LouisParkin]

Approved without comments.