revert: drop the disproven repository-cache automerge theory

See merge request !134

fix(renovate): split typescript pins out of the pin-dependencies group

See merge request !135

fix(containers): move tool image to ubi10 for python 3.12

See merge request !136

The 2026-08-06 automerge tier deliberately stopped short of ordinary
patch and minor, recording that it was "a version decision, so it stays
with a person until there is evidence this tier was safe." Measured
2026-08-11 against the estate's entire Renovate history -- 12 weeks, all
147 merged and all 127 closed renovate/* merge requests -- that evidence
now exists: the ordinary class merged 72 of 72 with zero commits beyond
the bot's own, and none of its 74 closures was a human rejecting the
update. The gate has produced 72 waves-through and 0 judgment calls.

Grant automerge to patch and minor. The taxonomy is deliberate: Renovate
has no security update type, so patch+minor is exactly the measured
class; pin, digest and lockFileMaintenance already automerge above;
pinDigest cannot arise with pinDigests off estate-wide; rollback is a
downgrade and replacement changes package identity, and the evidence
covers neither.

The shipping floor is untouched. The rule is placed above every rule
naming a shipping class, so catalog, major, the Go toolchain, UBI,
cosign, syft and the typescript ceiling all continue to override it back
to human review. The 7-day minimumReleaseAge is not waived here, unlike
the pin/digest tier, because a version bump is a real decision and still
soaks. Verified by before/after dry runs on manifold, postern and
bulkhead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

feat(renovate): automerge ordinary patch and minor updates

See merge request !137

chore(deps): update dependency uv to v0.12.1

See merge request !128

Zig renamed its release tarballs after 0.14.0: the artifact and its
extracted directory are now zig-x86_64-linux-<version>, arch before
OS. The Containerfile hardcoded the old form, so Renovate's correct
0.13.0 -> 0.15.1 bump in !111 404s six times and fails the build.
Bumping the pin and the pattern together keeps both resolvable; the
bot rebases !111 and drops its zig hunk.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

fix(containers): adopt zig's renamed release artifacts at 0.15.1

See merge request !138

feat(bot-maintenance): declare the estate's credentials and audit them

See merge request !139

GO_VERSION=1.26.4 carries GO-2026-5856 (CVE-2026-42505): an Encrypted
Client Hello handshake discloses its pre-shared key identity in
cleartext to a passive network observer, fixed upstream in 1.26.5.

GOLANGCI_LINT_VERSION=v2.4.0 predates Go 1.26 support entirely --
golangci-lint's own analysis passes panic on syntax the 1.26 parser
accepts, so every consumer running golangci-lint from this image
(directly, or via the audit component's Go arm) has had the check
silently allow_failure-carried or hand-disabled since its toolchain
crossed 1.26. Bumped alongside the Go pin because the panic is why
the CVE fix would have gone unexercised.

Resolves the instance behind
#5;
the scheduled-cadence automation that item also proposes is separate
follow-up and not shipped here.

Shipped as v6.1.0 (minor), matching this catalog's own precedent for
a Go toolchain bump: both prior instances (1.25.7 -> 1.26.3 in
v3.3.0, -> 1.26.4 in v4.1.0) landed inside a minor release, never a
patch alone.

Verified go1.26.5 and golangci-lint v2.12.2 both exist and are
non-prerelease, against go.dev's download JSON and the golangci-lint
GitHub releases API. hadolint against the changed file surfaces one
pre-existing, unrelated finding (DL4006, missing SHELL -o pipefail
ahead of the install script's curl | sh) present identically before
this change. No image build performed locally.

See CHANGELOG.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Andrew Dunn <andunn@gitlab.com>

fix(images): bump ci-go's Go to 1.26.5 and golangci-lint to v2.12.2

See merge request !140