ci: run Renovate from asxpi/renovate

Renovate now runs from its own repository for every repo, with the
shared rules in its preset. Extend that preset here and keep only what
is specific to this repo (the Ansible var manager, the Paper JRE, the
runner and nix notes); drop the workflow that ran it for iac alone.

Assisted-by: Claude:opus-5-5

nixos/modules/docker.nix

@@ -0,0 +1,25 @@
+# Docker, set up as on the Debian hosts. Declared containers become
+# systemd units named docker-<name>.service.
+{ config, ... }:
+{
+  virtualisation.docker = {
+    enable = true;
+    storageDriver = "overlay2";
+    # For containers nobody declared here, such as CI jobs. Declared
+    # containers log to the journal instead.
+    logDriver = "json-file";
+    daemon.settings.log-opts.max-size = "20m";
+  };
+  virtualisation.oci-containers.backend = "docker";
+
+  # Every image update and CI job leaves an image behind
+  systemd.services.docker-image-prune = {
+    description = "Remove images no container uses";
+    after = [ "docker.service" ];
+    requires = [ "docker.service" ];
+    path = [ config.virtualisation.docker.package ];
+    serviceConfig.Type = "oneshot";
+    script = "docker image prune -af";
+    startAt = "Mon 03:00";
+  };
+}