Keep the ghcr.io/devture/ansible image in the docs up to date via Renovate

docs/ansible.md pins a ghcr.io/devture/ansible tag in its `docker run`
examples, which used to be bumped by hand. devture/docker-ansible now tags
releases automatically, so Renovate can propose them. The devcontainer's
Dockerfile, already seen by the dockerfile manager, gets updated in the same
pull request.

The image's tags (`<Alpine ansible package version>-<release>`) need regex
versioning: Docker versioning would treat `-r0-3` as a compatibility suffix
and never offer `-r0-4`.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.github/renovate.json

@@ -50,6 +50,18 @@
       "matchStrings": [
         "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) packageName=(?<packageName>\\S+)\\s+MATRIX_RENOVATE_VERSION: '(?<currentValue>[^']+)'"
       ]
+    },
+    {
+      "customType": "regex",
+      "description": "Update the ghcr.io/devture/ansible image referenced in the documentation. The devcontainer's Dockerfile is handled by the built-in dockerfile manager.",
+      "managerFilePatterns": [
+        "/^docs\\/ansible\\.md$/"
+      ],
+      "matchStrings": [
+        "ghcr\\.io\\/devture\\/ansible:(?<currentValue>[^\\s`]+)"
+      ],
+      "depNameTemplate": "ghcr.io/devture/ansible",
+      "datasourceTemplate": "docker"
     }
   ],
   "packageRules": [
@@ -66,6 +78,13 @@
       ],
       "allowedVersions": "/^v0\\./"
     },
+    {
+      "description": "ghcr.io/devture/ansible is tagged `<Alpine ansible package version>-<release>` (e.g. `14.0.0-r0-3`). Docker versioning would consider `-r0-3` a compatibility suffix and never offer `-r0-4`",
+      "matchDepNames": [
+        "ghcr.io/devture/ansible"
+      ],
+      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-r(?<build>\\d+)-(?<revision>\\d+)$"
+    },
     {
       "description": "Housekeeping updates merge via branch push (no PR, no email); a failure on the branch still surfaces as a PR. i18n/requirements.txt bumps are exercised by the Matrix i18n workflow before merging.",
       "matchFileNames": [

bin/renovate-smoke-test.sh

@@ -66,6 +66,11 @@ if ! jq --slurp --exit-status '
         and any(.packageFiles.regex[]?.deps[]?;
             .depName == "matrix-renovate-runner" and .datasource == "docker")
     )
+    and any(.[];
+        .msg == "Extracted dependencies"
+        and any(.packageFiles.regex[]?.deps[]?;
+            .depName == "ghcr.io/devture/ansible" and .datasource == "docker")
+    )
 ' "$log_file"; then
     echo 'Renovate did not complete dependency extraction successfully' >&2
     exit 1