fix(ci): skip heavy jobs on renovate branches, automerge digest and patch

Renovate branches only carry version/digest bumps, so scan-deps, test-backend, test-frontend and build just burn runner time on the box that also serves prod. Static checks and validate still run. Digest and patch updates automerge (playwright, helm and major rules below still override to no-automerge). Also replaces deprecated helm --atomic with --wait --rollback-on-failure.

renovate/renovate.json

@@ -149,6 +149,11 @@
     }
   ],
   "packageRules": [
+    {
+      "description": "Automerge digest and patch updates - safe by definition, review adds nothing, keeps the renovate queue and the deploy line short. Specific no-automerge rules below still override this for playwright, helm and majors.",
+      "matchUpdateTypes": ["digest", "patch"],
+      "automerge": true
+    },
     {
       "description": "Keep private homelab images unchanged",
       "matchDatasources": ["docker"],