Pin exact versions of images and actions

Floating tags (17-alpine, 3.4-slim, nginx:alpine, :latest, :debug, @v7)
change under a deploy without anyone deciding it: the storage deploy
moved Postgres to 17.12 on its own because of postgres:17-alpine. Pin
every image and action to its exact current version, so each change
arrives as a reviewed Renovate PR and a rollback is a revert.

Assisted-by: Claude:opus-5-5

renovate.json

@@ -13,16 +13,76 @@
       "matchStrings": [
         "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+)\\s+[a-z_0-9]+:\\s*\"?(?<currentValue>[^\"\\s]+)\"?"
       ]
+    },
+    {
+      "description": "Runner job images, pinned in the labels: docker://<image>:<tag>",
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^ansible/roles/forgejo_runner/(templates/config\\.yaml\\.j2|tasks/main\\.yaml)$/"
+      ],
+      "matchStrings": [
+        "docker://(?<depName>[a-z0-9./_-]+):(?<currentValue>[A-Za-z0-9._-]+)"
+      ],
+      "datasourceTemplate": "docker"
     }
   ],
   "packageRules": [
     {
-      "description": "Paper needs Java 21; the tag is a floating JRE line",
+      "description": "Paper needs Java 21: patch updates of the 21 JRE only",
       "matchPackageNames": [
         "eclipse-temurin"
       ],
+      "allowedVersions": "/^21\\./"
+    },
+    {
+      "description": "Runner labels name their line (node-20, debian-12, python-3.11): never leave it",
+      "matchFileNames": [
+        "ansible/roles/forgejo_runner/**"
+      ],
+      "matchUpdateTypes": [
+        "major"
+      ],
       "enabled": false
     },
+    {
+      "description": "python-3.11 / python-3.12 labels stay on their minor line",
+      "matchFileNames": [
+        "ansible/roles/forgejo_runner/**"
+      ],
+      "matchPackageNames": [
+        "python"
+      ],
+      "matchCurrentValue": "/^3\\.11\\./",
+      "allowedVersions": "/^3\\.11\\./"
+    },
+    {
+      "matchFileNames": [
+        "ansible/roles/forgejo_runner/**"
+      ],
+      "matchPackageNames": [
+        "python"
+      ],
+      "matchCurrentValue": "/^3\\.12\\./",
+      "allowedVersions": "/^3\\.12\\./"
+    },
+    {
+      "description": "archlinux tags are base-YYYYMMDD.0.BUILD",
+      "matchPackageNames": [
+        "archlinux"
+      ],
+      "versioning": "regex:^base-(?<major>\\d{8})\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
+    },
+    {
+      "description": "Both label files carry the same pins: one PR per image",
+      "matchFileNames": [
+        "ansible/roles/forgejo_runner/**"
+      ],
+      "groupName": "runner job images",
+      "matchUpdateTypes": [
+        "minor",
+        "patch"
+      ]
+    },
     {
       "description": "Every job runs this image and a nix-store volume tied to its version",
       "matchPackageNames": [