fix(ci): skip heavy jobs on renovate branches, automerge digest and patch

Renovate branches only carry version/digest bumps, so scan-deps, test-backend, test-frontend and build just burn runner time on the box that also serves prod. Static checks and validate still run. Digest and patch updates automerge (playwright, helm and major rules below still override to no-automerge). Also replaces deprecated helm --atomic with --wait --rollback-on-failure.

.gitea/workflows/deploy.yaml

@@ -73,14 +73,14 @@ jobs:
     needs: [validate]
     runs-on: [self-hosted, linux, arch, homelab, prod]
     # Apply only, no verification, so this is just the work itself: snapshot,
-    # then sequential `helm upgrade --atomic --timeout 10m`, then the apply loop.
+    # then sequential `helm upgrade --install --wait --rollback-on-failure --timeout 10m`, then the apply loop.
     # Verification has its own job and its own budget.
     #
     # 45 is roughly four times the measured cost of the stage, which is
     # deliberately not raised on a theory:
     #
     #   helm, healthy          3 no-op upgrades              ~3-5 min
-    #   helm, one release bad  --atomic spends its 10m,      ~10-15 min
+    #   helm, one release bad  rollback-on-failure spends its 10m,      ~10-15 min
     #                            then rolls that one back
     #   apply loop             ~40 manifests, 4 of which     ~1 min
     #                           resolve an image digest