chore(deps): pin streaming images, isolate python and floating tags

Python Y-bumps arrived as minor 3.11->3.14 and floating tags (:latest/:beta) were automerged blindly. Pin the linuxserver stack to digest-verified tags and keep python plus rolling images in manual review groups.

renovate/k8s/configmap.yaml

@@ -218,6 +218,34 @@ data:
           "matchUpdateTypes": ["patch"],
           "groupName": "all patch updates",
           "groupSlug": "all-patch"
+        },
+        {
+          "description": "Python Y-bumps break compat (3.11->3.12->3.13->3.14) - keep the base image out of the shared minor/patch groups, review every bump separately. Placed last so its groupName wins.",
+          "matchDatasources": ["docker"],
+          "matchPackageNames": ["python"],
+          "groupName": "python base image",
+          "groupSlug": "python",
+          "automerge": false
+        },
+        {
+          "description": "Rolling/floating tags (streaming stack, nextcloud beta, kubectl latest) - never automerge, every bump is a manual review. Placed last so automerge:false wins over the shared digest/patch rule.",
+          "matchDatasources": ["docker"],
+          "matchPackageNames": [
+            "lscr.io/linuxserver/jellyfin",
+            "lscr.io/linuxserver/qbittorrent",
+            "lscr.io/linuxserver/sonarr",
+            "lscr.io/linuxserver/radarr",
+            "lscr.io/linuxserver/prowlarr",
+            "lscr.io/linuxserver/bazarr",
+            "ghcr.io/seerr-team/seerr",
+            "fallenbagel/jellyseerr",
+            "ghcr.io/lampac-nextgen/lampac",
+            "ghcr.io/nextcloud-releases/all-in-one",
+            "alpine/kubectl"
+          ],
+          "groupName": "floating images - manual",
+          "groupSlug": "floating-manual",
+          "automerge": false
         }
       ]
     }

renovate/renovate.json

@@ -207,6 +207,34 @@
       "matchUpdateTypes": ["patch"],
       "groupName": "all patch updates",
       "groupSlug": "all-patch"
+    },
+    {
+      "description": "Python Y-bumps break compat (3.11->3.12->3.13->3.14) - keep the base image out of the shared minor/patch groups, review every bump separately. Placed last so its groupName wins.",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["python"],
+      "groupName": "python base image",
+      "groupSlug": "python",
+      "automerge": false
+    },
+    {
+      "description": "Rolling/floating tags (streaming stack, nextcloud beta, kubectl latest) - never automerge, every bump is a manual review. Placed last so automerge:false wins over the shared digest/patch rule.",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": [
+        "lscr.io/linuxserver/jellyfin",
+        "lscr.io/linuxserver/qbittorrent",
+        "lscr.io/linuxserver/sonarr",
+        "lscr.io/linuxserver/radarr",
+        "lscr.io/linuxserver/prowlarr",
+        "lscr.io/linuxserver/bazarr",
+        "ghcr.io/seerr-team/seerr",
+        "fallenbagel/jellyseerr",
+        "ghcr.io/lampac-nextgen/lampac",
+        "ghcr.io/nextcloud-releases/all-in-one",
+        "alpine/kubectl"
+      ],
+      "groupName": "floating images - manual",
+      "groupSlug": "floating-manual",
+      "automerge": false
     }
   ]
 }