chore(renovate): add SOPS round-trip postUpgradeTasks + self-hosted runner

Address review feedback on SOPS handling for encrypted values.yaml.

- renovate.json: Renovate has NO preUpgradeTasks option (verified against
  the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks
  (which run after the tag bump, before the commit): decrypt the values.yaml,
  then re-encrypt. Encrypting an already-encrypted file would double-encrypt
  the existing ENC secret values. Only **/values.yaml is re-encrypted; the
  docker-compose and Chart.yaml files are not SOPS-encrypted here.
- kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob
  running the renovatebot/renovate image, with sops allowed as a
  postUpgradeTask command and the SOPS PGP key loaded to re-encrypt
  values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources.
- Wire code/renovate into the root kubernetes kustomization.

renovate.json

@@ -9,6 +9,16 @@
     "helm-values",
     "helmv3"
   ],
+  "postUpgradeTasks": {
+    "description": "SOPS round-trip on encrypted values.yaml. Renovate has no preUpgrade hook, so the decrypt must happen here: after the tag bump but before commit, decrypt the file, then re-encrypt. Encrypting an already-encrypted file would double-encrypt the existing ENC secret values and corrupt them.",
+    "commands": [
+      "sops -d {{packageFile}} > {{packageFile}}.plain && mv {{packageFile}}.plain {{packageFile}} && sops -e -i {{packageFile}}"
+    ],
+    "fileFilters": [
+      "**/values.yaml"
+    ],
+    "executionMode": "update"
+  },
   "packageRules": [
     {
       "description": "docker-compose updates",