chore(renovate): add SOPS round-trip postUpgradeTasks + self-hosted runner

Address review feedback on SOPS handling for encrypted values.yaml.

- renovate.json: Renovate has NO preUpgradeTasks option (verified against
  the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks
  (which run after the tag bump, before the commit): decrypt the values.yaml,
  then re-encrypt. Encrypting an already-encrypted file would double-encrypt
  the existing ENC secret values. Only **/values.yaml is re-encrypted; the
  docker-compose and Chart.yaml files are not SOPS-encrypted here.
- kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob
  running the renovatebot/renovate image, with sops allowed as a
  postUpgradeTask command and the SOPS PGP key loaded to re-encrypt
  values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources.
- Wire code/renovate into the root kubernetes kustomization.

kubernetes/code/renovate/git-renovate-gpg.key

@@ -0,0 +1,9 @@
+# SOPS PGP PRIVATE key for fingerprint DC6910268E657FF70BA7EC289974494E76938DDC
+#
+# PLACEHOLDER — replace with the actual ASCII-armored PRIVATE key used to
+# encrypt .sops.yaml files, then sops-encrypt this file before committing
+# (wrap the whole file as a single value matching the `.*key` regex in
+# .sops.yaml, or store it via the .pre-commit flow). Keep it out of git in
+# plaintext; this is a Secret source.
+#
+# -----BEGIN PGP PRIVATE KEY BLOCK----- ... -----END PGP PRIVATE KEY BLOCK-----