refactor(renovate): freeze evidence by path, not by repository

Andrew Dunnrequested to merge
chore/path-based-freeze into main

What

Corrects !97 (merged). Freezes evidence by path rather than by repository, replacing two packageRules with one and dropping the carve-out.

Why !97 (merged) was on the wrong axis

Of the 18 remaining lab/** projects, only 7 hold receipts at all:

holds receipts → freeze correct no receipts → freeze wrong
aigw-streaming-truncation bench evidence project-lattice/mcp — Rust MCP server
airgap-fips bench evidence project-trustchain/caproni-lab — deployment config
dap-offline evidence project-trustchain/architecture — ADR site
ironbank-posture evidence credit-console — admin tool
rootless archive bench evidence factory, gitlab-profile, +6 more
service-ping-ingress-isolation evidence rig
workspaces-airgap evidence

Two failures in one rule: it froze eleven tools and doc sites that must stay current, and it would have rotted the seven receipt-bearing labs' own site builds and CI — which loses the evidence just as surely as bumping it.

renovation-posture-design.md argued for exactly this axis — "the distinction we need is per-path and per-purpose, not per-repo." !97 (merged) implemented the inverse. This is the correction.

How

bench/**  archive/**  evidence/**  experiments/**  rig/**  receipts/**  results/**

each with a **/-prefixed twin so the directory matches at the repository root and nested.

Benefits over the repo axis:

  • The 11 tool/doc labs go live again with no per-repo files.
  • The 7 receipt-bearing labs freeze exactly their experimental conditions, while their site builds and CI stay current.
  • An evidence directory appearing in a non-lab project is covered automatically.
  • No enumeration of projects to maintain as labs are added — the same enumeration drift being eliminated elsewhere in this catalog.
  • The .gitlab-ci.yml carve-out becomes unnecessary: a lab's CI file was never under an evidence directory.

Validation

  • Globs checked against real minimatch, 19 cases, all correct — including the negatives that would have bitten: benchmarks/x/Dockerfile and site/src/rigging.ts do not match, while sub/dir/bench/x/Dockerfile does.
  • renovate-config-validator --strict clean on all three config files (pinned renovate@43.272.0).
  • Validator control-tested: a bogus matchFileNamesTYPO in the same position is rejected, so acceptance of matchFileNames is meaningful rather than a silently-ignored key.

Also here

The 13 unmaintained lab/project-* hackathon repositories now carry their own {"enabled": false} — kept as reference for new work rather than maintained software, so updates there generate review nobody will read. Left writable rather than archived so code can still be lifted out. Their 25 dangling Renovate MRs were closed.

CHANGELOG's [Unreleased] entry is corrected in place rather than contradicted, since 4.x has not shipped.

Merge request reports