feat(homelab): isolate PR runner and add Paperless

.gitea/workflows/renovate-ci.yaml

@@ -28,6 +28,8 @@ permissions:
 
 jobs:
   validate-renovate:
+    permissions:
+      contents: read
     runs-on: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && 'homelab' || 'homelab-pr' }}
     timeout-minutes: 20
     steps:
@@ -35,6 +37,7 @@ jobs:
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       # renovate/k8s/cronjob.yaml is the single source of truth for the version.
       - name: Resolve the deployed Renovate version