[Dependency/Sync] Add Renovate maintenance windows, limits, and digest grouping

[stranske]

Why

renovate-presets/fleet.json:4-40 groups minor/patch updates but leaves digest updates outside the GitHub Actions group and does not define a schedule, commit rate, branch limit, PR limit, release age, PR-creation gate, or major-update approval. In the 2026-06-14..2026-08-01 audit window, 460 of 974 retrievable Renovate PRs were digest updates; grouped non-major work merged 174/180 while frequent digest families produced much more discarded work. This is a current intake-control gap, not evidence that routine Renovate grouping should be removed.

Scope

• Add a bounded weekly maintenance window and fleet branch/PR budgets.
• Group trusted GitHub Actions digest/pin/minor/patch updates together.
• Delay routine PR creation until branch checks are not pending and releases have aged.
• Route majors through the Dependency Dashboard while security updates bypass routine cadence.

Non-Goals

• Do not revert to Dependabot or disable platform auto-merge for clean routine updates.
• Do not delay vulnerability-alert/security updates behind the weekly window.
• Do not include the nine Workflows-owned dev-tool pins disabled at fleet.json:11-15.
• Scaffold-only completion does NOT count: adding undocumented keys without schema validation and a representative dry-run is not completion.

Tasks

• Update renovate-presets/fleet.json with a documented weekly 4-hour schedule, commitHourlyLimit, prConcurrentLimit, and branchConcurrentLimit set to conservative fleet values.
• Extend the GitHub Actions package rule at renovate-presets/fleet.json:29-35 to group digest, pin, minor, and patch updates for trusted actions.
• Add routine-update minimumReleaseAge and prCreation policy without applying those delays to vulnerability alerts.
• Add a major-update rule using dependencyDashboardApproval while preserving visible, actively handled majors.
• Define grouped lock-file maintenance cadence explicitly instead of inheriting an always-available default.
• Add tests/workflows/test_renovate_fleet_policy.py to parse the real preset and assert the schedule, limits, security bypass, digest grouping, dev-tool exclusions, and major lane.
• Update docs/ci/TOOL_VERSION_MANAGEMENT.md, docs/WORKFLOW_GUIDE.md, and renovate-presets/README.md with the intake budget and emergency/security path.
• Add the Renovate config validator command to scripts/dev_check.sh or the existing dependency-policy validation job.

Acceptance Criteria

• python -m pytest tests/workflows/test_renovate_fleet_policy.py tests/workflows/test_dependency_bot_conditions.py -q passes.
• Renovate config validation accepts renovate.json, renovate-presets/fleet.json, and any inherited generated preset.
• A representative Renovate dry-run for Workflows and one consumer reports at most three concurrent routine branches and groups trusted GitHub Actions digest updates into one branch.
• The dry-run evidence shows a routine non-security release is held by the maintenance/release-age policy while a vulnerability-alert update is not held.
• Deliberate-break gate: temporarily remove digest from the GitHub Actions group; tests/workflows/test_renovate_fleet_policy.py::test_trusted_action_digests_are_grouped must fail. Restore the rule before review.

Implementation Notes

• Current preset: renovate-presets/fleet.json; Workflows override: renovate.json; consumer entrypoint: templates/consumer-repo/.github/renovate.json.
• Related tests/docs: tests/workflows/test_dependency_bot_conditions.py, tests/workflows/test_consumer_sync_create_only_evidence.py, docs/ci/TOOL_VERSION_MANAGEMENT.md, docs/WORKFLOW_GUIDE.md, docs/ops/CONSUMER_REPO_MAINTENANCE.md, and scripts/dev_check.sh.
• Start with commitHourlyLimit: 1 or 2, prConcurrentLimit: 3, and branchConcurrentLimit: 3; change these only with dry-run evidence.
• Preserve native automerge for the green routine lane and a no-delay security path.

[stranske]

Sequencing — keep open until durable verifier PASS

PR #2893 merged (18f25a9c) and GitHub auto-closed this issue. Closer policy keeps the source issue open until the merged PR has a durable provider-comparison / verifier PASS with no remaining disposition debt.

• Merged PR: feat(renovate): bound fleet maintenance intake #2893
• Label applied: verify:compare
• Next: wait for verifier report on feat(renovate): bound fleet maintenance intake #2893; close this issue only after PASS (or disposition a bounded follow-up on non-PASS).

[stranske]

Closer note: merged PR #2893 has a durable split verifier report (openai CONCERNS / anthropic PASS). Code policy landed on main, but dry-run / deliberate-break acceptance criteria remain unmet, so this issue stays open. See PR #2893 comment for the disposition details.

[stranske]

#2877 acceptance evidence (closer 2026-08-02)

Config validation

INFO: Validating renovate.json as repo config
 INFO: Validating renovate-presets/fleet.json as repo config
 INFO: Validating templates/consumer-repo/.github/renovate.json as repo config
 INFO: Config validated successfully against 3 file(s)

Pytest + deliberate-break

• Baseline test_trusted_action_digests_are_grouped PASS on main 6b845c26.
• Deliberate-break: removed digest from github-actions matchUpdateTypes → test FAILED with AssertionError ([pin,minor,patch] vs expected including digest).
• Restored preset → test PASS; full suite test_renovate_fleet_policy.py + test_dependency_bot_conditions.py → 10 passed.

Renovate dry-run (npx renovate@37.440.7, --dry-run=full, LOG_LEVEL=debug)

stranske/Workflows

• Digest updates coalesced to single branch renovate/github-actions (7 digest updates → 1 branchName).
• Routine branches considered: renovate/github-actions, renovate/weekly-lock-file-maintenance (≤3 concurrent routine branches; branchConcurrentLimit calculated as 3).
• Both routine branches held by maintenance schedule: Skipping branch creation as not within schedule.
• Applied vulnerability-alert force config observed in debug resolve: schedule: [], minimumReleaseAge: null, prCreation: immediate, commitMessageSuffix: [SECURITY] (security path not subject to routine cadence). No live GHSA update branch was pending in this window, so the bypass is evidenced by Renovate’s applied force block rather than a second created branch.

stranske/trip-planner (consumer)

• Trusted Actions digests coalesced to renovate/github-actions (held by schedule).
• Routine non-major bucket present as renovate/non-major-updates with pendingChecks: true / result pending (matches prCreation: not-pending).
• Major renovate/actions-setup-python-7.x blocked by dependencyDashboardApproval=true (not a routine branch).
• Lock-file maintenance held by schedule.

Key log lines:

# Workflows
DEBUG: Calculating branchConcurrentLimit (3) (repository=stranske/Workflows)
DEBUG: Skipping branch creation as not within schedule (repository=stranske/Workflows, branch=renovate/github-actions)
DEBUG: Skipping branch creation as not within schedule (repository=stranske/Workflows, branch=renovate/weekly-lock-file-maintenance)
"isVulnerabilityAlert": true,
           "force": {
             "groupName": null,
             "schedule": [],
             "dependencyDashboardApproval": false,
             "minimumReleaseAge": null,
             "rangeStrategy": "update-lockfile",
             "commitMessageSuffix": "[SECURITY]",
             "branchTopic": "{{{datasource}}}-{
# trip-planner
"pendingChecks": true,
DEBUG: Processing 4 branches: renovate/actions-setup-python-7.x, renovate/github-actions, renovate/non-major-updates, renovate/weekly-lock-file-maintenance (repository=stranske/trip-planner)
DEBUG: Calculating branchConcurrentLimit (3) (repository=stranske/trip-planner)
DEBUG: Skipping branch creation as not within schedule (repository=stranske/trip-planner, branch=renovate/github-actions)
DEBUG: Branch renovate/actions-setup-python-7.x creation is disabled because dependencyDashboardApproval=true (repository=stranske/trip-planner, branch=renovate/actions-setup-python-7.x)
DEBUG: Skipping branch creation as not within schedule (repository=stranske/trip-planner, branch=renovate/weekly-lock-file-maintenance)
"pendingChecks": true,

[stranske]

Closer disposition: merged #2893 code + 2026-08-02 dry-run/deliberate-break/config-validator evidence satisfy the remaining acceptance criteria. See evidence comment above. Closing.