Adds a `renovate_bot_dry_run` CI job that reuses the same Renovate
invocation as `renovate_bot` but stops before creating or updating
any branches or merge requests. It runs only when `$RENOVATE_DRY_RUN`
is set (`extract`, `lookup`, or `full`), which Renovate reads
natively.

The job does not extend `.renovate_bot_auth_config` and does not use
the vault-scoped `RENOVATE_GITLAB_TOKEN`, so it can run on merge
requests and non-protected branches. `RENOVATE_GITLAB_TOKEN` defaults
to `$CI_JOB_TOKEN`, which is enough for the read-only dry-run modes.
Callers can override at the project or pipeline level to reach
private registries with `lookup` or `full`.

The regular `renovate_bot` job is unchanged and keeps its schedule
and default-branch rules.

This unblocks downstream smoke tests in
https://gitlab.com/gitlab-com/gl-infra/common-ci-task-tests that
validate image or config upgrades before rolling them out — see
!1717
and https://github.com/renovatebot/renovate/discussions/42740 for
the motivating regression.

This reverts merge request !1722

feat(renovate-bot): add renovate_bot_dry_run job for smoke testing

See merge request !1724

## [4.33.0](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/compare/v4.32.0...v4.33.0) (2026-07-27)

Revert "Merge branch 'renovate/renovate-43.x' into 'main'"

See merge request !1727

chore(deps): update pre-commit hook gitlab-com/gl-infra/common-ci-tasks to v4.33

See merge request !1726

chore(deps): update dependency docker/cli to v29.6.2

See merge request !1720

chore(deps): update dependency jdx/mise to v2026.7.7

See merge request !1721

fix(deps): Run Renovate via node instead of npx to avoid EDITOR injection

Closes #66

See merge request !1719

## [4.33.1](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/compare/v4.33.0...v4.33.1) (2026-07-28)