ci(renovate): track the tool versions pinned in workflows and actions

[jimisola]

ⓘ Same class of bug as the Nisse pin Renovate skipped for a missing xmlns: a pinned version that nothing updates is not a pin — it is a version nobody is watching.

What & Why

Four tool versions were invisible to every Renovate manager, because they live in composite-action input defaults and a shell assignment rather than in a manifest:

Dependency	Version	Where
@antora/cli	3.1.14	build-antora-site
asciidoctor-kroki	0.18.1	build-antora-site
orhun/git-cliff	2.13.1	setup-git-cliff
rhysd/actionlint	1.7.7	ci.yml

A # renovate: comment above each now makes it a tracked dependency, picked up by a custom manager.

Not the customManagers:githubActionsVersions preset — that expects the value on a SOMETHING_VERSION: key, and three of these are action-input default:s. I wrote the two matchStrings instead and tested them against the real files; they discover exactly these four and nothing else:

npm              @antora/cli            3.1.14
npm              asciidoctor-kroki      0.18.1
github-releases  orhun/git-cliff        2.13.1
github-releases  rhysd/actionlint       1.7.7

Config validated with renovate-config-validator.

The git-cliff wrinkle

Renovate can bump the version but cannot compute the new SHA-256, so a bump will fail the checksum. That is correct — failing closed is exactly what a pinned digest is for. But the failure should not be a puzzle, so it now prints both digests and says which input to change:

::error::git-cliff 2.14.0 checksum mismatch.
::error::  expected: 9a1263f2…
::error::  actual:   4f2b81ce…
::error::If you are bumping the version, set the sha256 input default to the actual value above.

One copy-paste per git-cliff release, versus never updating it at all.

Also: holds asciidoctor-kroki below 1.x

{
  // asciidoctor-kroki 1.x is not compatible with Antora, which is the only
  // thing that uses it here. Lift when Antora supports it.
  matchDepNames: ["asciidoctor-kroki"],
  allowedVersions: "<1",
}

Per @jimisola. This should auto-close reqstool.github.io#41 and stop v1 being re-proposed — the incompatibility was only recorded in a chat thread until now.

Author checklist

• matchStrings tested against the real files — 4 found, as expected
• renovate-config-validator passes
• actionlint, zizmor, yamllint, permissions check, action tests all clean
• Conventional Commit title, DCO sign-off

Test Plan

After merge, Renovate should open PRs for any of the four that are behind, and close #41. Worth checking its next run picks up all four rather than a subset — a custom manager that silently matches nothing is the failure mode to watch for here.