chore(renovate): add SOPS round-trip postUpgradeTasks + self-hosted runner

Address review feedback on SOPS handling for encrypted values.yaml.

- renovate.json: Renovate has NO preUpgradeTasks option (verified against
  the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks
  (which run after the tag bump, before the commit): decrypt the values.yaml,
  then re-encrypt. Encrypting an already-encrypted file would double-encrypt
  the existing ENC secret values. Only **/values.yaml is re-encrypted; the
  docker-compose and Chart.yaml files are not SOPS-encrypted here.
- kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob
  running the renovatebot/renovate image, with sops allowed as a
  postUpgradeTask command and the SOPS PGP key loaded to re-encrypt
  values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources.
- Wire code/renovate into the root kubernetes kustomization.

kubernetes/code/renovate/kustomization.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: renovate
+resources:
+  - namespace.yaml
+  - cronjob.yaml
+# Scalar Renovate env vars (token, SOPS key fingerprint, ...). Stored as a
+# dotenv file and SOPS-encrypted by the .pre-commit hook (matches .env rule).
+configMapGenerator:
+  - name: renovate-config
+    files:
+      - config.json=config.json
+secretGenerator:
+  - name: renovate-secrets
+    envs:
+      - renovate.env
+  # SOPS PGP private key needed by the renovate runner to re-encrypt
+  # values.yaml during postUpgradeTasks. Mounted into the pod and imported
+  # into the container gpg keyring at startup.
+  - name: renovate-gpg
+    files:
+      - git-renovate-gpg.key