Keep Molecule Python updates within Ansible support

.github/renovate.json

@@ -127,6 +127,22 @@
       "automerge": true,
       "automergeType": "branch"
     },
+    {
+      "description": "Molecule's pinned ansible-core 2.21 supports controller Python through 3.14. Keep Python updates below 3.15 until Ansible supports the newer minor and the scenarios pass on it.",
+      "matchManagers": [
+        "github-actions"
+      ],
+      "matchFileNames": [
+        ".github/workflows/molecule.yml"
+      ],
+      "matchDepNames": [
+        "python"
+      ],
+      "matchDepTypes": [
+        "uses-with"
+      ],
+      "allowedVersions": "<3.15"
+    },
     {
       "description": "Automerge patch bumps of components whose role has a Molecule scenario (via branch push - no PR). A bump touches that role's defaults/main.yml, which makes the Molecule workflow run that role's scenario, so the update only merges once the component has been started on the configuration the role renders. Patch is the baseline for every covered role; explicitly approved roles may also appear in the narrower minor rule below. Keep this list in step with the roles that have a scenario - bin/check-molecule-automerge-list.py (patch rule) enforces that.",
       "matchFileNames": [

docs/molecule-testing.md

@@ -29,6 +29,9 @@ Molecule is deliberately **not** part of the `prek` hooks. A run is far too slow
 CI uses Python 3.14, which is supported by the pinned Ansible dependencies. Keep the
 workflow's Python minor version within Ansible's supported controller versions;
 an unrestricted `3.x` can select a newer Python before Ansible supports it.
+Renovate limits this workflow's Python dependency to `<3.15` while the pinned
+Ansible supports Python only through 3.14. Raise the workflow pin and this Renovate
+limit together after upgrading Ansible and verifying the scenarios on the newer Python.
 
 `.github/workflows/molecule.yml` does not run every scenario on every push — with one repository holding every role, that would be unaffordable. Its first job works out which roles the push actually touched, keeps the ones that have a scenario, and builds the job matrix from those. A documentation change runs nothing.