fix(deps): restore trustworthy dependency automation

[FelixTJDietrich]

Description

Restore Renovate's dependency inventory around the repository's current Bun, Maven, container, and GitHub Actions toolchain. Security fixes now bypass routine dashboard approval and release-age controls without being auto-merged, while routine updates are split into reviewable runtime, developer-tooling, Actions, and container changes.

This also resolves Dependabot alert #501 by upgrading @hey-api/openapi-ts from 0.97.1 to the minimum patched 0.97.3 release and regenerating the checked-in client. The generator configuration explicitly selects its plugins, so regeneration is warning-free and continues applying date transformers to SDK responses. The separate TypeScript 7 compatibility work remains in #1466.

Release signing stays immutable: every Cosign installer reference now uses the same verified full SHA for v4.1.2. Routine image upgrades are no longer mislabeled as security fixes or forced into collision-prone broad groups.

Closes #1570

How to test

npx --yes --package renovate renovate-config-validator --strict renovate.json
bun run generate:api:application-server:client
bun run verify

Expected results:

• Renovate configuration validates without warnings.
• Client generation reports @hey-api/openapi-ts v0.97.3 without duplicate-plugin warnings.
• The generated client diff is deterministic.
• All Cosign installer references use 6f9f17788090df1f26f669e9d70d6ae9567deba6 (v4.1.2).

Local verification completed successfully: 992 webapp tests, 168 custom lint-rule tests, 1,625 Storybook browser tests, 7,098 server unit/architecture tests, coverage checks, and the webapp, Storybook, and documentation production builds.

After merge, the hosted Renovate run must refresh the Dependency Dashboard and GitHub must rescan bun.lock before the dashboard cleanup and alert closure are externally visible.

Checklist

• Added an empty changeset because this maintenance change has no operator- or user-facing release note.
• No operator action, required environment variable, or manual migration is introduced.

[coderabbitai]

Warning

Review limit reached

Next included review available in 35 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 91d31e16-b078-4a20-af1c-2805b43d8307

📥 Commits

Reviewing files that changed from the base of the PR and between 46ca3d3 and 926c516.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (11)

• .changeset/solid-ends-decide.md
• .github/workflows/reusable-docker-build.yml
• SECURITY.md
• docs/contributor/release-management.mdx
• renovate.json
• webapp/openapi-ts.config.ts
• webapp/package.json
• webapp/src/api/client/client.gen.ts
• webapp/src/api/client/types.gen.ts
• webapp/src/api/client/utils.gen.ts
• webapp/src/api/core/params.gen.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Documentation Preview

This PR includes documentation changes. A preview has been deployed:

🔗 View Docs Preview

_{Preview for commit 926c516. Updates automatically on new commits.}

[github-actions]

🧩 Storybook Preview

Review this pull request's components and interaction states:

🔗 View Storybook Preview

_{Preview for commit 926c516. Updates automatically on new commits.}