ci: run Renovate from asxpi/renovate

Renovate now runs from its own repository for every repo, with the
shared rules in its preset. Extend that preset here and keep only what
is specific to this repo (the Ansible var manager, the Paper JRE, the
runner and nix notes); drop the workflow that ran it for iac alone.

Assisted-by: Claude:opus-5-5

nixos/hosts/asxpio-services/xray.nix

@@ -0,0 +1,32 @@
+# Xray VLESS Reality proxy on :443, host network. Root in the container
+# only to read the 0400 config and bind :443; every other capability is
+# dropped.
+{ config, ... }:
+let
+  # renovate: datasource=docker depName=ghcr.io/xtls/xray-core
+  xrayVersion = "26.11.9";
+in
+{
+  # The whole config.json; a new one restarts the container
+  sops.secrets."xray/config".restartUnits = [ "docker-xray.service" ];
+
+  virtualisation.oci-containers.containers.xray = {
+    image = "ghcr.io/xtls/xray-core:${xrayVersion}";
+    cmd = [
+      "run"
+      "-c"
+      "/etc/xray/config.json"
+    ];
+    user = "0";
+    volumes = [ "${config.sops.secrets."xray/config".path}:/etc/xray/config.json:ro" ];
+    extraOptions = [
+      "--network=host"
+      "--cap-drop=ALL"
+      "--cap-add=NET_BIND_SERVICE"
+      "--security-opt=no-new-privileges:true"
+      "--read-only"
+    ];
+  };
+
+  networking.firewall.allowedTCPPorts = [ 443 ];
+}