feat(renovate): PR-age cooldown for registries without trusted timestamps

[DevSecNinja]

Problem

Verified against the latest Renovate run log for DevSecNinja/truenas-apps (Renovate 43.280.0):

Marking N release(s) as pending, as they do not have a releaseTimestamp
  and we're running with minimumReleaseAgeBehaviour=timestamp-required
Branch renovate/ghcr.io-…traefik-forward-auth-4.x creation is disabled
  because internalChecksFilter was not met

Renovate v42+ defaults minimumReleaseAgeBehaviour: timestamp-required and deliberately does not trust the publisher-controlled OCI org.opencontainers.image.created annotation. Images from ghcr.io / lscr.io / quay.io expose no trusted release timestamp, so every release is marked pending and internalChecksFilter: strict refuses to open a branch. The update parks under the dashboard's "Pending Status Checks" section and no PR is ever created — 30 of 35 branches were blocked this way, incl. traefik-forward-auth (stuck at 4.8.0 since March, ref DevSecNinja/truenas-apps#115).

Neither native option alone is acceptable: timestamp-required never merges these; timestamp-optional opens PRs but skips the soak entirely, contradicting ADR 0004.

Solution — measure the soak from PR age for these registries

• .renovate/packageRules.json5: minimumReleaseAgeBehaviour: "timestamp-optional" scoped to docker deps on ghcr.io/lscr.io/quay.io → Renovate opens the PR and enables platformAutomerge.
• .github/workflows/renovate-pr-cooldown.yml (new reusable workflow): posts a required pr-cooldown commit status that stays pending until the PR branch head commit is ≥ 14 days old (a rebase to a newer version restarts the clock). GitHub auto-merge merges the moment it turns green. Human and non-gated PRs always get success, so the required check never blocks anything else.
• Local caller (renovate-pr-cooldown-caller.yml), workflow-templates/ entry + .properties.json for adoption.
• ADR 0005 documents the decision; the misleading base.json5 internalChecksFilter comment from fix(renovate): set internalChecksFilter to strict #284 is corrected (strict is the right default for the timestamp-required path, not the fix for the stuck updates).

Datasources with trusted timestamps (docker.io, github tags/releases) keep the native soak and are not gated by pr-cooldown.

Consuming-repo wiring (per ADR 0005)

1. Add the caller workflow from workflow-templates/renovate-pr-cooldown.yml (triggers: pull_request, schedule, workflow_dispatch).
2. Add pr-cooldown to the branch ruleset's required status checks.

Validation

actionlint, zizmor (no findings), yamllint, yamlfmt -lint, dprint check all clean (via config-sync/files configs); JSON5 presets parse; embedded github-script node --check + a mocked decision matrix (gated-old→success, gated-new→pending, docker.io→pass, human→pass) all correct.

Caveat

docker.io images that also lack a timestamp (e.g. dozzle/cloudflared/mongo) are intentionally not gated here, per "only the registries we know are unreliable." They can be added to gated-branch-prefixes + the packageRule later if desired.

Refs DevSecNinja/truenas-apps#115