feat(renovate): add manual run pipeline and sync configs

renovate-run workflow_dispatch runs pinned renovate via docker on self-hosted runner. Sync helm-values manager into config.js/configmap, bump compose and validator pins to 44.97.2.

renovate/README.md

@@ -24,12 +24,25 @@ The `renovate/k8s/active` marker makes the normal deployment workflow include
 the namespace, ConfigMap, and CronJob. The Secret is intentionally excluded
 from Git and must be applied separately after every new cluster.
 
-Run it immediately instead of waiting for the six-hour schedule:
+Run it immediately instead of waiting for the six-hour schedule.
+
+Two options, both use the same `renovate/config.js`:
 
 ```sh
 kubectl create job --from=cronjob/renovate renovate-manual-$(date +%s) -n renovate
 ```
 
+or the `renovate-run` Actions workflow (Actions tab → `renovate-run` →
+Run workflow). It runs `renovate/renovate:44.97.2` on the self-hosted
+runner via Docker. Required Actions secrets (repo or org settings):
+
+- `RENOVATE_TOKEN` — renovate-bot PAT (repository + issue read/write).
+- `RENOVATE_GITHUB_COM_TOKEN` — optional, for changelogs and GitHub rate limits.
+
+Inputs: `repositories` (default `forust/homelab`), `log_level`
+(`info`/`debug`). Only one run at a time (concurrency group
+`renovate-run`), same as the CronJob `Forbid` policy.
+
 Inspect runs with:
 
 ```sh