Run Renovate from GitHub Actions

.github/renovate.json

@@ -7,6 +7,7 @@
   "labels": [
     "dependencies"
   ],
+  "branchConcurrentLimit": 3,
   "hostRules": [
     {
       "matchHost": "https://mau.dev",
@@ -38,6 +39,16 @@
       "matchStrings": [
         "# renovate: datasource=(?<datasource>[a-z-.]+?) depName=(?<depName>[^\\s]+?)\\s+[A-Za-z0-9_]+?\\s*:\\s*[\"'][^:]+:(?<currentValue>[^\"']+)[\"']"
       ]
+    },
+    {
+      "customType": "regex",
+      "description": "Update the self-hosted Renovate runner version",
+      "managerFilePatterns": [
+        "/^\\.github\\/workflows\\/renovate\\.yml$/"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) packageName=(?<packageName>\\S+)\\s+MATRIX_RENOVATE_VERSION: '(?<currentValue>[^']+)'"
+      ]
     }
   ],
   "packageRules": [
@@ -75,6 +86,7 @@
         ".github/workflows/i18n.yml",
         ".github/workflows/lock-threads.yml",
         ".github/workflows/matrix.yml",
+        ".github/workflows/renovate.yml",
         ".github/workflows/update-translations.yml",
         "flake.lock",
         "i18n/requirements.txt",
@@ -83,6 +95,17 @@
       "automerge": true,
       "automergeType": "branch"
     },
+    {
+      "description": "Automerge updates of the self-hosted Renovate runner (via branch push - no PR)",
+      "matchManagers": [
+        "custom.regex"
+      ],
+      "matchDepNames": [
+        "matrix-renovate-runner"
+      ],
+      "automerge": true,
+      "automergeType": "branch"
+    },
     {
       "description": "Molecule's own dependencies merge via branch push (no PR, no email). Anything under molecule-shared/ - the helper container images, Postgres, and the Python pins - triggers the Molecule workflow, and a change to a shared file makes it run every scenario, so an update only merges once the whole suite has passed on it. A failure surfaces as a PR instead. This is how a new Postgres major reaches us: the bump runs every scenario against it before anything is merged.",
       "matchFileNames": [