Block a user
fix(renovate): the workflow still named renovate.json, so every run since #79 died with ENOENT
/approve-override
fix(renovate): the config was INVALID, so the first manual run errored out
fix(renovate): the cron fired outside Renovate's own window, so it would never open a PR
fix(pihole): make the split-horizon answer cacheable (local-ttl=60)
fix(conformance): one regex made the merge gate take 28 minutes instead of 2
fix(unattended-upgrades): Debian has no reboot-sentinel package, so ship the writer
feat(upgrades): automate node reboots (kured) and wire Renovate, which had never run
feat(shutdown): configure graceful node shutdown, and never scale a Delete-policy StatefulSet