[ENG-1702] Renovate: track Earthfile tool pins, the lunar-scripts base and GitHub Actions

[me-bender]

Adds .github/renovate.json5 (same shape as the other earthly repos that use Renovate: config:recommended, Monday schedule, renovate label, grouped non-major GitHub Actions) so the pinned tool versions stop rotting until a scanner complains.

What it tracks:

• Every ARG <TOOL>_VERSION= pin in an Earthfile that carries a # renovate: datasource=… depName=… comment on the line above (regex custom manager). This PR annotates the pins the ENG-1700 bump PR doesn't touch (checkov, ast-grep, hadolint, grype, node, npm); that PR annotates the ones it bumps.
• FROM pins in Earthfiles via the dockerfile manager: the earthly/lunar-scripts:$SCRIPTS_VERSION base (all six references grouped into one PR) and the golang: builder image. Test-only alpine:/python: images are excluded.
• GitHub Actions in .github/workflows and the lunar-policy pins in the policies' requirements.txt (built-in managers).
• helm is held <4 until the collector is validated on Helm 4.

Verification: renovate-config-validator passes; renovate --platform=local --dry-run=lookup on this branch plus the ENG-1700 branch detects 17 regex pins (all lookups resolve, no skipReason), 55 dockerfile deps including earthly/lunar-scripts ×6 and the golang builder, 11 GitHub Actions refs, 56 pip pins.

Prerequisite: the Renovate app is installed on the org but lunar-lib is not in its repository list yet, so nothing happens until it is added.

[lunar-internal]

🌙 Earthly Lunar

✅ 10 Passing

• ✅ ai.instruction-file-exists - Verifies that an agent instruction file exists at the repository root. Checks ai.instructions.all[] which is populated by the ai collector (AGENTS.md) and tool-specific collectors via array append (CLAUDE.md, CODEX.md, GEMINI.md). Passes if any entry exists.
• ✅ changelog.changelog-exists - Verifies that a CHANGELOG file exists in the repository root. Detects common variants (CHANGELOG.md, CHANGELOG, CHANGES.md, HISTORY.md, RELEASES.md). Intended for repos that ship versioned releases — apply via lunar-config on: targeting (e.g. public-only) rather than blanketly. Reads from .repo.changelog.
• ✅ repo-hygiene.codeowners-exists - Requires a CODEOWNERS file to be present in the repository. Checks standard locations: root, .github/, or docs/.

7 more...

• ✅ repo-hygiene.codeowners-valid - Validates that the CODEOWNERS file has correct syntax. Checks that all owner references use valid formats (@user, @org/team, or email).
• ✅ repo-hygiene.readme-exists - Verifies that a README file exists in the repository root. Every repository should have basic documentation for discoverability.
• ✅ sca-high.max-severity - Ensures no findings at or above the configured severity threshold. Configure min_severity to set the threshold (critical, high, medium, low).
• ✅ vcs.branch-protection-enabled - Requires branch protection rules to be enabled on the default branch. Branch protection is the foundation for all other VCS security controls.
• ✅ vcs.disallow-force-push - Prohibits force pushes to protected branches to preserve commit history. Force pushes can destroy audit trails and cause data loss.
• ✅ vcs.require-default-branch - Validates the default branch name matches the required name (default "main"). Helps standardize branch naming across repositories.
• ✅ vcs.require-pull-request - Requires all changes to go through pull requests before merging. Prevents direct pushes to protected branches without review.

More Details

[im-fry]

Read the config and every annotation. The regex matches all six pins with the right captures, the datasources are valid (node-version, npm, pypi, github-releases), and extractVersion strips the leading v on exactly the two tools whose install URLs re-add it (hadolint, grype) while staying off ast-grep, which downloads from a bare tag. alpine/python are excluded from the dockerfile manager and lunar-scripts x6 is grouped. renovate-config-validator passes on current renovate (v44); the only local fail was a v39 that predates managerFilePatterns. Does nothing until the app is added to the repo. Clean.