feat(manager/poetry): pass POETRY_SOLVER_MIN_RELEASE_AGE to Poetry when minimumReleaseAge is configured

[LuigiCerone]

Overview

This is a suggested sub-feature of #41652.

When minimumReleaseAge is configured in Renovate, Poetry invocations during lock file updates should set the POETRY_SOLVER_MIN_RELEASE_AGE environment variable so that Poetry's solver also enforces the age constraint on all resolved packages, including transitive dependencies.

Background

Poetry 2.4.0 introduced solver.min-release-age, which prevents the solver from considering package versions uploaded more recently than the specified number of days.
The equivalent environment variable is POETRY_SOLVER_MIN_RELEASE_AGE (integer, days).

Without this integration, Renovate's minimumReleaseAge only guards direct dependencies that Renovate proposes.
When Poetry regenerates poetry.lock, it can silently pull in brand-new transitive dependencies with no age filter, leaving a supply chain attack surface.

Proposed changes

When minimumReleaseAge is configured:

1. Convert the Renovate duration string to days: ceil(toMs(minimumReleaseAge) / 1 day)
2. Read [tool.poetry.solver] min-release-age from pyproject.toml if present
3. Set POETRY_SOLVER_MIN_RELEASE_AGE to the stricter (larger) of the two values
4. Pass it as an environment variable to all poetry update --lock invocations (both regular updates and lockFileMaintenance)

Notes

• Requires Poetry >=2.4.0
• If only pyproject.toml has min-release-age and Renovate has no minimumReleaseAge, no env var is set — Poetry reads the value from pyproject.toml directly, so behavior is unchanged
• solver.min-release-age-exclude and solver.min-release-age-exclude-source are out of scope — Poetry reads them from pyproject.toml automatically and they are unaffected by the env var

[jamietanna]

Thank you! Converted into #43430