fix(renovate): pin renovate-version — the action's default (39) rejects renovate.json5

Co-Authored-By: Claude Opus 5.5 <[email protected]>

decisions/2026-10-29-renovate-config-filename.md

@@ -23,6 +23,13 @@ passes and this filename is the only blocker observed.
 `.gitea/workflows/*.y*ml` must name a path that exists. This is valid YAML, so yamllint cannot see
 it, and the gate stayed green through 11 days of failures.
 
+**Second blocker, same PR:** the workflow did not pin a Renovate version, so
+`renovatebot/[email protected]` ran its default, Renovate **39** (`action.yml`:
+`renovate-version` `default: '39'`, read at that tag). `renovate.json5` uses `managerFilePatterns`,
+which needs >= 40.2.0. Under 39.264.0 the validator rejects the config with five errors. This was
+found and reproduced by the image-pipeline worker (PR #81). #79 had validated against `latest`. Pinned
+`renovate-version: 44.167.0`, the version the config validates clean against per that worker.
+
 ## What I verified
 
 - The root cause, from the run log quoted above, and that `origin/main` has `renovate.json5` and
@@ -36,6 +43,8 @@ it, and the gate stayed green through 11 days of failures.
 
 ## What I did NOT verify
 
+- **The 39.x rejection and the 44.167.0 pass were not reproduced by me.** I confirmed only the
+  action's default (`'39'`). The validation results are the PR #81 worker's.
 - **Renovate has still never completed a run.** This removes the observed blocker. Others may
   follow it. The test is a `workflow_dispatch` with `dry_run: true` after merge, and its log is
   the first evidence that Renovate authenticates, extracts dependencies, and honours `.json5`.