feat(renovate): audit that Renovate is delivering, fleet-wide

See merge request !124

fix(renovate): ignore labs, and stop treating group membership as ownership

See merge request !125

A required catch-all gates every merge request on a code-owner approval.
No author may approve their own and a bot has no second account, so an
automated dependency queue fills with merge requests that can never
merge, reaches prConcurrentLimit, and stops receiving proposals.

Observed on manifold: ten Renovate merge requests unmergeable from
2026-07-27, so catalog v5.0.0 and v6.0.0 could not be offered and were
pinned by hand. This repository carries the same shape and the same
protected-branch toggle.

The caret keeps the owner as reviewer without gating. The codeowners
standard is unaffected; it asserts a `* @handle` rule, still present.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

fix(renovate): exempt catalog bumps from the concurrent-MR cap

See merge request !126

chore(deps): update dependency uv to v0.12.0

See merge request !119

feat(renovate): automerge lockfile, pin and digest updates

See merge request !127

binary's publish-to-package-registry loop ran `curl --fail` with no
`set -e`, and the block's last statement was an always-successful
echo, so a failed upload could not fail the job -- a missing or
partial package on a green pipeline, with only a downstream 404
pointing back.

Fixed by adding `set -euo pipefail` to the affected blocks. The same
shape was audited across the whole catalog: binary's own sign-blob
loop had the identical defect (a failed cosign sign-blob on an early
file masked by a later file's success), container's :latest/:TAG push
blocks masked a failed buildah push behind a trailing digest echo, and
verify's :latest/:TAG blocks masked a failed cosign verify behind a
trailing "Verified" echo -- the highest-stakes instance, since verify
exists solely to assert signature integrity. All fixed the same way,
verified against the pre-fix and post-fix script text with stubbed
failing commands, including that the intended non-tag/absent-digest
skip paths still exit 0 under the newly added `set -u`.

automerge-gate and osv-verdict omit `set -e` deliberately (documented
in-file) and were left as-is; release's upload-release-assets uses
`curl ... || true` intentionally for optional release-page links to
artifacts already durably published elsewhere. See CHANGELOG.md for
the full audit.

Signed-off-by: Andrew Dunn <andunn@gitlab.com>

fix(renovate): exempt the automerge tier from minimumReleaseAge

See merge request !129

fix(renovate): stop persisting branch state across runs

See merge request !130

fix(renovate): survive token rotation with ignorePrAuthor

See merge request !131

fix: Fail loud on masked upload, push, and verify failures

See merge request !132

Signed-off-by: Andrew Dunn <andunn@gitlab.com>

chore(release): cut catalog v6.0.1

See merge request !133