chore(renovate): add SOPS round-trip postUpgradeTasks + self-hosted runner

Address review feedback on SOPS handling for encrypted values.yaml.

- renovate.json: Renovate has NO preUpgradeTasks option (verified against
  the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks
  (which run after the tag bump, before the commit): decrypt the values.yaml,
  then re-encrypt. Encrypting an already-encrypted file would double-encrypt
  the existing ENC secret values. Only **/values.yaml is re-encrypted; the
  docker-compose and Chart.yaml files are not SOPS-encrypted here.
- kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob
  running the renovatebot/renovate image, with sops allowed as a
  postUpgradeTask command and the SOPS PGP key loaded to re-encrypt
  values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources.
- Wire code/renovate into the root kubernetes kustomization.

kubernetes/code/renovate/cronjob.yaml

@@ -0,0 +1,71 @@
+# Self-hosted Renovate runner.
+#
+# Runs the managed `renovatebot/renovate` image on a schedule against the
+# `vhaudiquet/homeprod` repo (see config.json). Because we need to run SOPS
+# during postUpgradeTasks (re-encrypting values.yaml), Renovate cannot run on
+# the Mend-hosted app — it must be self-hosted with the sops command allow-listed
+# (see config.json -> allowedPostUpgradeCommands) and the SOPS PGP private key
+# loaded (renovate-gpg secret below).
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: renovate
+  namespace: renovate
+spec:
+  # Run every hour; Renovate's own "schedule": ["every weekend"] (config.json)
+  # gates when PRs are actually created.
+  schedule: "42 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 2
+  failedJobsHistoryLimit: 4
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      template:
+        spec:
+          restartPolicy: Never
+          tolerations:
+            - key: CriticalAddonsOnly
+              operator: Exists
+          containers:
+            - name: renovate
+              image: renovatebot/renovate:latest
+              envFrom:
+                - secretRef:
+                    name: renovate-secrets
+              env:
+                - name: RENOVATE_CONFIG_FILE
+                  value: /etc/renovate/config.json
+                - name: LOG_LEVEL
+                  value: info
+              command:
+                - /bin/sh
+                - -ec
+                - |
+                  set -eu
+                  # Import the SOPS PGP private key so rebuild/enable SOPS
+                  # re-encryption in postUpgradeTasks works.
+                  gpg --batch --import /etc/renovate/gpg/git-renovate-gpg.key || true
+                  exec renovate
+              volumeMounts:
+                - name: config
+                  mountPath: /etc/renovate/config.json
+                  subPath: config.json
+                  readOnly: true
+                - name: gpg
+                  mountPath: /etc/renovate/gpg
+                  readOnly: true
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 384Mi
+                limits:
+                  cpu: 1000m
+                  memory: 1Gi
+          volumes:
+            - name: config
+              configMap:
+                name: renovate-config
+            - name: gpg
+              secret:
+                name: renovate-gpg