Renovate for all repos, with a shared preset

Renovate ran from the iac repo for iac only. Run it from here for every
repo that should get version bump PRs, with the rules they share in
default.json (local>asxpi/renovate): bundler held at nixpkgs' 2.7.2,
Postgres majors flagged as migrations, action bumps grouped.

Repos without a renovate.json get an onboarding PR first, so nothing
changes in a repo until its config is merged.

Assisted-by: Claude:opus-5-5

.forgejo/workflows/renovate.yaml

@@ -0,0 +1,36 @@
+name: renovate
+
+# One Renovate run for every repo listed below. A repo without a
+# renovate.json first gets a "Configure Renovate" PR (extending
+# local>asxpi/renovate); nothing else happens there until it is merged.
+#
+# Secrets: RENOVATE_TOKEN (renovate-bot, which needs Write access to each
+# repo) and GH_COM_TOKEN (read-only github.com token, for release notes).
+
+on:
+  schedule:
+    - cron: "17 5 * * *"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/renovatebot/renovate:44.236.2
+    steps:
+      - name: Run Renovate
+        env:
+          RENOVATE_PLATFORM: forgejo
+          RENOVATE_ENDPOINT: https://git.asxp.io/api/v1
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GH_COM_TOKEN }}
+          RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate-bot@noreply.git.asxp.io>"
+          RENOVATE_REPOSITORIES: >-
+            ["asxpi/iac", "asxpi/asxpio", "asxpi/datacenterbingo",
+             "asxpi/storage", "asxpi/blog", "czsk/czsk",
+             "asxpi/veryhighpriestbot"]
+          RENOVATE_ONBOARDING: "true"
+          RENOVATE_ONBOARDING_CONFIG: '{"$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": ["local>asxpi/renovate"]}'
+          RENOVATE_REQUIRE_CONFIG: required
+          LOG_LEVEL: info
+        run: renovate