ci: revert Renovate — close the composite-refs gap in the existing radar

[chaudharydeepanshu]

Reverts the 2.2.0 Renovate migration and closes the one gap it existed for (composite action.yml refs Dependabot can't see, dependabot-core#6704) directly in the existing upgrade radar.

What changes

• Deletes the reusable renovate.yml. The self-hosted Renovate machine — dashboard issue, per-consumer renovate.json5, status-check + token-scope surface — was far more than the single blind spot it was brought in for.
• New opt-in composite-refs job in the reusable upgrade-check.yml:
  • sweeps every whuppi/ci/…@vX.Y.Z ref across .github (workflows and composites) to the latest release — uniform, so the pin never splits;
  • pins third-party actions inside composites (e.g. actions/cache) to the latest SHA via pinact.
  • Off by default; a consumer opts in with sweepActions: true + CI_ACTIONS_TOKEN and adds whuppi/ci* to its Dependabot ignore.
• Division of labour, no overlap: Dependabot owns pub deps + third-party actions in workflow files; composite-refs owns whuppi/ci refs everywhere + third-party actions in composites.
• Adds pinact to the pinned tool supply chain (PINACT_VERSION), owned by self-upgrade.yml like actionlint/zizmor.
• Renames the org secret RENOVATE_TOKEN → CI_ACTIONS_TOKEN (same Workflows-scope PAT). secrets.sh's org scope stays — it's generic.

Verified locally

• actionlint + zizmor --persona=auditor: clean across all workflows.
• pinact run --update --exclude '^whuppi/ci/' proven against pdf's real composites: bumps the frozen actions/cache@v5.0.5 → v6.1.0 in both composites, leaves whuppi/ci refs untouched.
• shellcheck clean on upgrade.sh.

Cut as v2.3.0 on merge (the CHANGELOG top heading is in the diff).

[slopfairy]

Tip

Approved — focused replacement that closes the composite-refs gap with a tenth of the surface area Renovate required

🟡 Suggestions — optional, take it or leave it

1. .github/workflows/upgrade-check.yml line ~260 (pinact step) — the composite-refs job calls go install and go env GOPATH, which requires Go on the runner. The default ubuntu-24.04 has it, but runs-on is an open input a consumer can override. A consumer picking a macOS or Windows runner without Go would hit a hard failure. Consider documenting this in the sweepActions input comment, or guarding with a command -v go check and a clear error.

✅ Checked

• Security: no pull_request_target, no untrusted input in run: blocks. The latest release tag from gh api is validated against ^v[0-9]+\.[0-9]+\.[0-9]+$ before landing in sed — proper injection guard. CI_ACTIONS_TOKEN (PAT) handles writes while GITHUB_TOKEN stays at contents: read for pinact's API reads. Both checkouts use persist-credentials: false.
• Supply chain: PINACT_VERSION="4.1.0" in tool/versions.env, tracked by tool/ci/upgrade.sh and bumped by self-upgrade.yml — same pattern as ACTIONLINT_VERSION and ZIZMOR_VERSION. Go module checksum provides integrity; no separate hash needed.
• Internal refs: ref: main on the whuppi/ci checkout passes internal-refs-are-main. The @main ref on uses: whuppi/ci/actions/capabilities/fvm@main (line 186, existing) is untouched.
• Conventional commit: ci: type is in tool/commit-types.txt. Title format passes.
• Bash safety: set -euo pipefail on all three run blocks. Quoted expansions, heredoc output passing, no bare variable references. Shellcheck is reported clean.
• Division of labour: Dependabot keeps pub deps + third-party actions in workflow files; composite-refs owns only whuppi/ci refs (uniform across workflows and composites) + third-party actions inside composite action.yml. The --exclude '^whuppi/ci/' on pinact and the grep -rlE sweep pattern agree — no overlap, no double-bump.
• Documentation: CHANGELOG, UPDATING.md, and in-file comments are all accurate and match the code.
• Dependabot config: .github/dependabot.yml is unchanged, correctly — whuppi/ci's own actions dirs are still scanned by Dependabot (this repo doesn't use the composite-refs job on itself).
• deploy changes: secrets.json.example key rename matches; secrets.sh comment update is accurate. No logic changes.