Merge pull request 'feat(ci): run the merge gate inside the CI-built toolbox image, pinned by digest' (#147) from feat/gate-toolbox-container into main

Reviewed-on: #147
Reviewed-by: Keith Jackson <[email protected]>

renovate.json5

@@ -144,7 +144,9 @@
       "description": "This repo's own CI-published images, pinned by digest, following the tag named in a `# renovate-digest:` marker on the previous line.",
       "managerFilePatterns": [
         "/(^|/)versions\\.env$/",
-        "/(^|/)platform/pm-agent/.+\\.ya?ml$/"
+        "/(^|/)platform/pm-agent/.+\\.ya?ml$/",
+        // ADDED 2026-11-08: the merge gate's job `container:` is the toolbox, by digest.
+        "/^\\.gitea/workflows/gate\\.ya?ml$/"
       ],
       "matchStrings": [
         "#\\s*renovate-digest:\\s*image=(?<depName>\\S+)\\s+tag=(?<currentValue>\\S+)\\s*\\n[^\\n]*?(?<currentDigest>sha256:[a-f0-9]{64})"
@@ -313,8 +315,8 @@
       "enabled": false
     },
     {
-      "description": "ADDED 2026-10-29. This repo's own images are followed ONLY through the `# renovate-digest:` markers above. The `kubernetes` manager also sees platform/pm-agent/deployment.yaml and infra/agent/worker-job-template.yaml, where the image has a digest and no tag; left on, it would look those up as `latest` (a tag CI never pushes) and, for the template, re-open the self-referential loop the custom manager deliberately avoids.",
-      "matchManagers": ["kubernetes"],
+      "description": "ADDED 2026-10-29. This repo's own images are followed ONLY through the `# renovate-digest:` markers above. The `kubernetes` manager also sees platform/pm-agent/deployment.yaml and infra/agent/worker-job-template.yaml, where the image has a digest and no tag; left on, it would look those up as `latest` (a tag CI never pushes) and, for the template, re-open the self-referential loop the custom manager deliberately avoids. `github-actions` ADDED 2026-11-08 for the same reason: it extracts the gate job's digest-only `container: image:` in .gitea/workflows/gate.yml, which the custom manager already follows through its marker.",
+      "matchManagers": ["kubernetes", "github-actions"],
       "matchPackageNames": [
         "gitea.home.keithjackson.dev/home-network/toolbox",
         "gitea.home.keithjackson.dev/home-network/agent-runner",