chore(ci): bump catalog to v2.1.1 + adopt PST renovate preset

Andrew Dunnrequested to merge
chore/catalog-v2.1.1 into main

Summary

  • Bump 9 component refs from @v2.1.0 to @v2.1.1. v2.1.1's binary template restores a conditional cosign install for non-catalog build_image. tach builds on golang:1.25 (non-catalog), so this becomes functionally relevant on the next tag pipeline.
  • Add renovate.json extending the PST shared preset (gitlab>gitlab-com/public-sector-tools/pipeline//presets/renovate.json). No prior Renovate config. Will pick up Go module bumps + future catalog tags automatically.

Test plan

  • MR pipeline green (lint, test, build-check, scans)
  • No regressions in pre-existing job graph
  • Tag-pipeline binary signing path validated on next tag (smoke)

Merge request reports