fix(renovate): stop asserting a file and calling it delivery

The renovate standard asserted three things about renovate.json: that it exists, that its first extends entry names the catalog preset, and that it defines no gitlab block.

kaniko satisfied all three for three months while receiving no updates at all, because three push rules rejected the bot. The standard reported PASS over a project that was completely broken. That is configuration conformance standing in for delivery, and they are not the same property.

Three corrections

The file is no longer required, and requiring it asserted a superseded model. The runner sets RENOVATE_REQUIRE_CONFIG: optional and injects the preset as base config for every discovered project, precisely so coverage stops depending on each project remembering a file (37 of 57 had none under the old required model). The invariant inverts: not "you opted in", but "if you ship your own config, it extends the preset rather than replacing it". applies_when_file 'renovate.json' gives exactly that, so a project with no config SKIPs rather than fails.

The taught example pointed at the deprecated path. It showed pipeline//presets/renovate.json, which resolves only because a shim at that path forwards to the real preset. All four real consumers use pipeline:renovate-config. The example now teaches the canonical form and names the shim as the old location.

The limit is stated rather than implied. A new Why configuration conformance is not delivery section explains what came apart and why the gap cannot close here: reading projects/:id/push_rule needs Maintainer, so a per-project check would mean distributing a privileged token to every project, and "Renovate never visited me" is undetectable from inside one project because an unscanned repo looks identical to one with no dependencies.

The frontmatter unasserted: field now names the catalog's renovate-fleet-audit job as what audits the property this standard cannot, so the generated ## Verify block carries that caveat wherever the standard is read:

Not asserted: that updates actually arrive. Enrollment, push rules and the bot's own run health are live properties outside this tree; the catalog's renovate-fleet-audit job asserts them fleet-wide.

Verification

just guard, just validate (7 of 7), and just check (20 of 20) all green. Confirmed the new precondition behaves: a tree with no renovate.json now emits SKIP renovate/applies instead of a FAIL.

Paired with pipeline!124 (merged), which adds the fleet audit this standard defers to.