Renovate ran from the iac repo for iac only. Run it from here for every
repo that should get version bump PRs, with the rules they share in
default.json (local>asxpi/renovate): bundler held at nixpkgs' 2.7.2,
Postgres majors flagged as migrations, action bumps grouped.
Repos without a renovate.json get an onboarding PR first, so nothing
changes in a repo until its config is merged.
Assisted-by: Claude:opus-5-5
