chore(deps): Update docker.io/library/python Docker tag to v3.15.2

Reviewed-on: #163
Reviewed-by: Keith Jackson <[email protected]>

.gitea/workflows/renovate.yaml

@@ -151,7 +151,7 @@ jobs:
     # actions/checkout: Renovate clones the repo itself from RENOVATE_ENDPOINT, and as uid 12021
     # checkout could not `git init` the root-owned workspace volume anyway.
     container:
-      image: ghcr.io/renovatebot/renovate:44.167.0
+      image: ghcr.io/renovatebot/renovate:44.227.4
     # Renovate scans every manager across the whole repo; 40m is generous for this repo's size and
     # well under a runner's patience. Without a timeout a wedged run holds the `renovate`
     # concurrency group and silently blocks every subsequent scheduled run.

apps/wave-1/semaphore.yaml

@@ -78,7 +78,7 @@ spec:
     spec:
       containers:
       - name: semaphore
-        image: semaphoreui/semaphore:v2.19.17
+        image: semaphoreui/semaphore:v2.20.23
         ports:
         - containerPort: 3000
         env:

catalog/semaphore.yaml

@@ -22,7 +22,7 @@
 name: semaphore
 kind: container
 source:
-  image: semaphoreui/semaphore:v2.19.17   # pinned recent stable tag (R-UPD-01); update.range governs advancement
+  image: semaphoreui/semaphore:v2.20.23   # pinned recent stable tag (R-UPD-01); update.range governs advancement
 env:
   # --- PostgreSQL connection (the CNPG-DB pattern). DIALECT/HOST/PORT/DB/USER are literals; PASS is
   #     sourced from the in-namespace SOPS secret (the CNPG -app secret lives in ns semaphore-db,

infra/agent/versions.env

@@ -18,7 +18,7 @@
 # digest. For a LOCAL build on a local toolbox, override it:
 #   infra/devcontainer/dev.sh build && AGENT_BASE_IMAGE=home-k3s-dev:local infra/agent/build-image.sh
 # renovate-digest: image=gitea.home.keithjackson.dev/home-network/toolbox tag=main
-AGENT_BASE_IMAGE=gitea.home.keithjackson.dev/home-network/toolbox@sha256:d435fabd6fc43bf5bb4de0c1ea8c4b19d8cea5c858679bd1675ccbed471b528a
+AGENT_BASE_IMAGE=gitea.home.keithjackson.dev/home-network/toolbox@sha256:83a3501efe34fa0b039e3f0d360738686a0f59109866c49779768f5d5ed0ef81
 
 # Node.js — the runtime for the Claude Code CLI, installed from the Fedora base's module
 # stream. A major version, not a patch: the CLI supports the active LTS line and the

platform/monitoring/kube-prometheus-stack.yaml

@@ -24,7 +24,7 @@ spec:
   chart:
     spec:
       chart: kube-prometheus-stack
-      version: ">=88.0.0 <89.0.0"   # k8s-1.36 catch-up (po v0.93; CRDs pre-applied server-side, Helm won't update them). Renovate maintains
+      version: ">=93.1.1 <94.0.0"   # k8s-1.36 catch-up (po v0.93; CRDs pre-applied server-side, Helm won't update them). Renovate maintains
       sourceRef:
         kind: HelmRepository
         name: prometheus-community

platform/vuln-scanner/deployment.yaml

@@ -109,7 +109,7 @@ spec:
           # (19 days old; 3.14.10-alpine, the current 3.14-alpine, was built 2026-11-05 and is under
           # the 7-day age applied here by hand). Tracked by the `kubernetes` Renovate manager.
           # Runs as 65532 from this pod's securityContext; the image's default is root, overridden.
-          image: docker.io/library/python:3.14.9-alpine@sha256:dbeb11d16bb95c3a7e3c25c842cb9f20cbc8c18f8be0461a4a0dcc861ad386a0
+          image: docker.io/library/python:3.15.2-alpine@sha256:0f9552bb28711333da16915ec146f5e6bb44a7fdac9ced15dc17c2e0206346dd
           imagePullPolicy: IfNotPresent
           command:
             - python3